From 1ddddb6f3129dce029755a3353eb84a22d41a03b Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Mon, 6 Jul 2020 15:22:34 +0200 Subject: [PATCH 01/15] Warning to error in parse_ini_file() --- ext/standard/basic_functions.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c index 7051e4a456b8..6ff4c3d573f3 100755 --- a/ext/standard/basic_functions.c +++ b/ext/standard/basic_functions.c @@ -2647,8 +2647,8 @@ PHP_FUNCTION(parse_ini_file) ZEND_PARSE_PARAMETERS_END(); if (filename_len == 0) { - php_error_docref(NULL, E_WARNING, "Filename cannot be empty!"); - RETURN_FALSE; + zend_argument_value_error(1, "cannot be empty"); + RETURN_THROWS(); } /* Set callback function */ From 37629a7c29777d07e96e382c66eca2e32402b96f Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Mon, 6 Jul 2020 16:19:22 +0200 Subject: [PATCH 02/15] DNS --- ext/standard/dns.c | 32 +++++++++++++----------- ext/standard/tests/network/bug68925.phpt | 22 ++++++++++------ 2 files changed, 31 insertions(+), 23 deletions(-) diff --git a/ext/standard/dns.c b/ext/standard/dns.c index cb45eeebf3f7..e3154725c284 100644 --- a/ext/standard/dns.c +++ b/ext/standard/dns.c @@ -153,6 +153,7 @@ PHP_FUNCTION(gethostbyaddr) hostname = php_gethostbyaddr(addr); if (hostname == NULL) { + // TODO Convert to ValueError? #if HAVE_IPV6 && HAVE_INET_PTON php_error_docref(NULL, E_WARNING, "Address is not a valid IPv4 or IPv6 address"); #else @@ -210,10 +211,10 @@ PHP_FUNCTION(gethostbyname) Z_PARAM_STRING(hostname, hostname_len) ZEND_PARSE_PARAMETERS_END(); - if(hostname_len > MAXFQDNLEN) { + if (hostname_len > MAXFQDNLEN) { /* name too long, protect from CVE-2015-0235 */ - php_error_docref(NULL, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN); - RETURN_STRINGL(hostname, hostname_len); + zend_argument_value_error(1, "must be less than %d characters", MAXFQDNLEN); + RETURN_THROWS(); } RETURN_STR(php_gethostbyname(hostname)); @@ -233,11 +234,11 @@ PHP_FUNCTION(gethostbynamel) Z_PARAM_STRING(hostname, hostname_len) ZEND_PARSE_PARAMETERS_END(); - if(hostname_len > MAXFQDNLEN) { - /* name too long, protect from CVE-2015-0235 */ - php_error_docref(NULL, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN); - RETURN_FALSE; - } + if (hostname_len > MAXFQDNLEN) { + /* name too long, protect from CVE-2015-0235 */ + zend_argument_value_error(1, "must be less than %d characters", MAXFQDNLEN); + RETURN_THROWS(); + } hp = php_network_gethostbyname(hostname); if (!hp) { @@ -393,8 +394,9 @@ PHP_FUNCTION(dns_check_record) else if (!strcasecmp("NAPTR", rectype)) type = DNS_T_NAPTR; else if (!strcasecmp("A6", rectype)) type = DNS_T_A6; else { - php_error_docref(NULL, E_WARNING, "Type '%s' not supported", rectype); - RETURN_FALSE; + zend_argument_value_error(2, "must be one of \"A\", \"NS\", \"MX\", \"PTR\", \"ANY\", \"SAO\", \"CAA\", " + "\"TXT\", \"CNAME\", \"AAAA\", \"SRV\", \"NAPTR\", or \"A6\""); + RETURN_THROWS(); } } @@ -837,14 +839,14 @@ PHP_FUNCTION(dns_get_record) if (!raw) { if ((type_param & ~PHP_DNS_ALL) && (type_param != PHP_DNS_ANY)) { - php_error_docref(NULL, E_WARNING, "Type '" ZEND_LONG_FMT "' not supported", type_param); - RETURN_FALSE; + zend_argument_value_error(2, "must be one of DNS_A, DNS_CNAME, DNS_HINFO, DNS_CAA, DNS_MX, " + "DNS_NS, DNS_PTR, DNS_SOA, DNS_TXT, DNS_AAAA, DNS_SRV, DNS_NAPTR, DNS_A6, DNS_ALL, or DNS_ANY"); + RETURN_THROWS(); } } else { if ((type_param < 1) || (type_param > 0xFFFF)) { - php_error_docref(NULL, E_WARNING, - "Numeric DNS record type must be between 1 and 65535, '" ZEND_LONG_FMT "' given", type_param); - RETURN_FALSE; + zend_argument_value_error(2, "must be between 1 and 65535 when Argument #5 ($raw) is true"); + RETURN_THROWS(); } } diff --git a/ext/standard/tests/network/bug68925.phpt b/ext/standard/tests/network/bug68925.phpt index 764e13e0eda3..9333afba2806 100644 --- a/ext/standard/tests/network/bug68925.phpt +++ b/ext/standard/tests/network/bug68925.phpt @@ -2,12 +2,18 @@ Bug #68925 (CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow) --FILE-- ---EXPECTF-- -Warning: gethostbyname(): Host name is too long, the limit is %d characters in %s%ebug68925.php on line %d -string(2501) "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" +try { + var_dump(gethostbyname(str_repeat("0", 2501))); +} catch (\ValueError $e) { + echo $e->getMessage() . \PHP_EOL; +} +try { + var_dump(gethostbynamel(str_repeat("0", 2501))); +} catch (\ValueError $e) { + echo $e->getMessage() . \PHP_EOL; +} -Warning: gethostbynamel(): Host name is too long, the limit is %d characters in %s%ebug68925.php on line %d -bool(false) +?> +--EXPECT-- +gethostbyname(): Argument #1 ($hostname) must be less than 255 characters +gethostbynamel(): Argument #1 ($hostname) must be less than 255 characters From 881adfd80106c2ffb9a48277e652cc2e2284a409 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Mon, 6 Jul 2020 16:28:11 +0200 Subject: [PATCH 03/15] EXEC --- ext/standard/exec.c | 16 ++++++------ ext/standard/tests/misc/exec_basic1.phpt | 33 ++++++++++++++---------- 2 files changed, 27 insertions(+), 22 deletions(-) diff --git a/ext/standard/exec.c b/ext/standard/exec.c index 81135669f5e9..0be8df28e82f 100644 --- a/ext/standard/exec.c +++ b/ext/standard/exec.c @@ -220,12 +220,12 @@ static void php_exec_ex(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */ ZEND_PARSE_PARAMETERS_END(); if (!cmd_len) { - php_error_docref(NULL, E_WARNING, "Cannot execute a blank command"); - RETURN_FALSE; + zend_argument_value_error(1, "cannot be empty"); + RETURN_THROWS(); } if (strlen(cmd) != cmd_len) { - php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack"); - RETURN_FALSE; + zend_argument_type_error(1, "must not contain any null bytes"); + RETURN_THROWS(); } if (!ret_array) { @@ -523,12 +523,12 @@ PHP_FUNCTION(shell_exec) ZEND_PARSE_PARAMETERS_END(); if (!command_len) { - php_error_docref(NULL, E_WARNING, "Cannot execute a blank command"); - RETURN_FALSE; + zend_argument_value_error(1, "cannot be empty"); + RETURN_THROWS(); } if (strlen(command) != command_len) { - php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack"); - RETURN_FALSE; + zend_argument_type_error(1, "must not contain any null bytes"); + RETURN_THROWS(); } #ifdef PHP_WIN32 diff --git a/ext/standard/tests/misc/exec_basic1.phpt b/ext/standard/tests/misc/exec_basic1.phpt index 514c116d6853..61e057b728b3 100644 --- a/ext/standard/tests/misc/exec_basic1.phpt +++ b/ext/standard/tests/misc/exec_basic1.phpt @@ -8,18 +8,23 @@ exec, system, passthru — Basic command execution functions --FILE-- getMessage() . \PHP_EOL; +} +try { + var_dump(system($cmd, $output)); +} catch (\TypeError $e) { + echo $e->getMessage() . \PHP_EOL; +} +try { + var_dump(passthru($cmd, $output)); +} catch (\TypeError $e) { + echo $e->getMessage() . \PHP_EOL; +} ?> ---EXPECTF-- -Warning: exec(): NULL byte detected. Possible attack in %s on line %d -bool(false) -NULL - -Warning: system(): NULL byte detected. Possible attack in %s on line %d -bool(false) - -Warning: passthru(): NULL byte detected. Possible attack in %s on line %d -bool(false) +--EXPECT-- +exec(): Argument #1 ($command) must not contain any null bytes +system(): Argument #1 ($command) must not contain any null bytes +passthru(): Argument #1 ($command) must not contain any null bytes From 38f7146ff5cad9a5be42e36828d04f1718505aa0 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Mon, 6 Jul 2020 16:34:42 +0200 Subject: [PATCH 04/15] FileStats --- ext/standard/tests/file/chown.phpt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ext/standard/tests/file/chown.phpt b/ext/standard/tests/file/chown.phpt index 05cd4e4d7d41..6b737f1924b9 100644 --- a/ext/standard/tests/file/chown.phpt +++ b/ext/standard/tests/file/chown.phpt @@ -7,7 +7,11 @@ if(substr(PHP_OS, 0, 3) == "WIN") ?> --FILE-- getMessage() . \PHP_EOL; +} echo "ALIVE\n"; ?> --EXPECTF-- From 3b57aeac7109ce185e017c20081cc6744a983bec Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Mon, 6 Jul 2020 17:05:16 +0200 Subject: [PATCH 05/15] FTOK --- ext/standard/ftok.c | 4 ++-- ext/sysvshm/tests/001.phpt | 10 ++++++---- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/ext/standard/ftok.c b/ext/standard/ftok.c index 616890d283b2..04830fb6df62 100644 --- a/ext/standard/ftok.c +++ b/ext/standard/ftok.c @@ -40,8 +40,8 @@ PHP_FUNCTION(ftok) ZEND_PARSE_PARAMETERS_END(); if (pathname_len == 0){ - php_error_docref(NULL, E_WARNING, "Pathname is invalid"); - RETURN_LONG(-1); + zend_argument_value_error(1, "cannot be empty"); + RETURN_THROWS(); } if (proj_len != 1){ diff --git a/ext/sysvshm/tests/001.phpt b/ext/sysvshm/tests/001.phpt index 55d5444b98c1..106f6699ee87 100644 --- a/ext/sysvshm/tests/001.phpt +++ b/ext/sysvshm/tests/001.phpt @@ -7,8 +7,11 @@ if (!function_exists('ftok')){ print 'skip'; } ?> --FILE-- getMessage() . \PHP_EOL; +} var_dump(ftok(-1, -1)); var_dump(ftok("qwertyu","qwertyu")); @@ -19,8 +22,7 @@ var_dump(ftok(__FILE__,"q")); echo "Done\n"; ?> --EXPECTF-- -Warning: ftok(): Pathname is invalid in %s on line %d -int(-1) +ftok(): Argument #1 ($pathname) cannot be empty Warning: ftok(): Project identifier is invalid in %s on line %d int(-1) From 4dc51f6ff9ce3d5ca2692aac0407d9a37f1c29a2 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Mon, 6 Jul 2020 17:25:33 +0200 Subject: [PATCH 06/15] IPCT --- ext/standard/iptc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c index d7d7729db88c..ec3281eea87c 100644 --- a/ext/standard/iptc.c +++ b/ext/standard/iptc.c @@ -193,8 +193,8 @@ PHP_FUNCTION(iptcembed) } if (iptcdata_len >= SIZE_MAX - sizeof(psheader) - 1025) { - php_error_docref(NULL, E_WARNING, "IPTC data too large"); - RETURN_FALSE; + zend_argument_value_error(1, "must be less than %d characters", SIZE_MAX - sizeof(psheader) - 1025); + RETURN_THROWS(); } if ((fp = VCWD_FOPEN(jpeg_file, "rb")) == 0) { From 5ed963d106d75516f3bab2c5817ca4f4f0978c09 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Mon, 6 Jul 2020 17:36:51 +0200 Subject: [PATCH 07/15] Stream funcs --- ext/standard/streamsfuncs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/standard/streamsfuncs.c b/ext/standard/streamsfuncs.c index affe637e047d..0bc475498f39 100644 --- a/ext/standard/streamsfuncs.c +++ b/ext/standard/streamsfuncs.c @@ -1698,8 +1698,8 @@ PHP_FUNCTION(stream_socket_shutdown) if (how != STREAM_SHUT_RD && how != STREAM_SHUT_WR && how != STREAM_SHUT_RDWR) { - php_error_docref(NULL, E_WARNING, "Second parameter $how needs to be one of STREAM_SHUT_RD, STREAM_SHUT_WR or STREAM_SHUT_RDWR"); - RETURN_FALSE; + zend_argument_value_error(2, "must be one of STREAM_SHUT_RD, STREAM_SHUT_WR, or STREAM_SHUT_RDWR"); + RETURN_THROWS(); } php_stream_from_zval(stream, zstream); From 301150aefd4b5e8f9cde8a374d8c5e83998b6690 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Mon, 6 Jul 2020 17:50:10 +0200 Subject: [PATCH 08/15] User filter --- ext/standard/user_filters.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c index e60bce56be70..1095bf5072bb 100644 --- a/ext/standard/user_filters.c +++ b/ext/standard/user_filters.c @@ -300,8 +300,9 @@ static php_stream_filter *user_filter_factory_create(const char *filtername, efree(wildcard); } if (fdat == NULL) { - php_error_docref(NULL, E_WARNING, - "Err, filter \"%s\" is not in the user-filter map, but somehow the user-filter-factory was invoked for it!?", filtername); + zend_throw_error(NULL, "Filter \"%s\" is not in the user-filter map, " + "but user-filter-factory was invoked for it." + "This is a bug, please report it at https://bugs.php.net", filtername); return NULL; } } From 06d874f177f687c18249310a84c7c1be91bd9479 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Sat, 1 Aug 2020 23:56:38 +0100 Subject: [PATCH 09/15] DNS review --- ext/standard/dns.c | 6 +++--- ext/standard/tests/network/bug68925.phpt | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ext/standard/dns.c b/ext/standard/dns.c index e3154725c284..e131f16c3aa5 100644 --- a/ext/standard/dns.c +++ b/ext/standard/dns.c @@ -213,7 +213,7 @@ PHP_FUNCTION(gethostbyname) if (hostname_len > MAXFQDNLEN) { /* name too long, protect from CVE-2015-0235 */ - zend_argument_value_error(1, "must be less than %d characters", MAXFQDNLEN); + zend_argument_value_error(1, "cannot be longer than %d characters", MAXFQDNLEN); RETURN_THROWS(); } @@ -236,7 +236,7 @@ PHP_FUNCTION(gethostbynamel) if (hostname_len > MAXFQDNLEN) { /* name too long, protect from CVE-2015-0235 */ - zend_argument_value_error(1, "must be less than %d characters", MAXFQDNLEN); + zend_argument_value_error(1, "cannot be longer than %d characters", MAXFQDNLEN); RETURN_THROWS(); } @@ -845,7 +845,7 @@ PHP_FUNCTION(dns_get_record) } } else { if ((type_param < 1) || (type_param > 0xFFFF)) { - zend_argument_value_error(2, "must be between 1 and 65535 when Argument #5 ($raw) is true"); + zend_argument_value_error(2, "must be between 1 and 65535 when argument #5 ($raw) is true"); RETURN_THROWS(); } } diff --git a/ext/standard/tests/network/bug68925.phpt b/ext/standard/tests/network/bug68925.phpt index 9333afba2806..d0faba5c102e 100644 --- a/ext/standard/tests/network/bug68925.phpt +++ b/ext/standard/tests/network/bug68925.phpt @@ -15,5 +15,5 @@ try { ?> --EXPECT-- -gethostbyname(): Argument #1 ($hostname) must be less than 255 characters -gethostbynamel(): Argument #1 ($hostname) must be less than 255 characters +gethostbyname(): Argument #1 ($hostname) cannot be longer than 255 characters +gethostbynamel(): Argument #1 ($hostname) cannot be longer than 255 characters From 9915265c03cb13a7ca9d802d43c88cdb4111b224 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Thu, 6 Aug 2020 14:31:32 +0200 Subject: [PATCH 10/15] DNS reviews second round --- ext/standard/dns.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/ext/standard/dns.c b/ext/standard/dns.c index e131f16c3aa5..95271fda62dc 100644 --- a/ext/standard/dns.c +++ b/ext/standard/dns.c @@ -153,7 +153,6 @@ PHP_FUNCTION(gethostbyaddr) hostname = php_gethostbyaddr(addr); if (hostname == NULL) { - // TODO Convert to ValueError? #if HAVE_IPV6 && HAVE_INET_PTON php_error_docref(NULL, E_WARNING, "Address is not a valid IPv4 or IPv6 address"); #else @@ -394,8 +393,7 @@ PHP_FUNCTION(dns_check_record) else if (!strcasecmp("NAPTR", rectype)) type = DNS_T_NAPTR; else if (!strcasecmp("A6", rectype)) type = DNS_T_A6; else { - zend_argument_value_error(2, "must be one of \"A\", \"NS\", \"MX\", \"PTR\", \"ANY\", \"SAO\", \"CAA\", " - "\"TXT\", \"CNAME\", \"AAAA\", \"SRV\", \"NAPTR\", or \"A6\""); + zend_argument_value_error(2, "must be a valid DNS record type"); RETURN_THROWS(); } } @@ -839,8 +837,7 @@ PHP_FUNCTION(dns_get_record) if (!raw) { if ((type_param & ~PHP_DNS_ALL) && (type_param != PHP_DNS_ANY)) { - zend_argument_value_error(2, "must be one of DNS_A, DNS_CNAME, DNS_HINFO, DNS_CAA, DNS_MX, " - "DNS_NS, DNS_PTR, DNS_SOA, DNS_TXT, DNS_AAAA, DNS_SRV, DNS_NAPTR, DNS_A6, DNS_ALL, or DNS_ANY"); + zend_argument_value_error(2, "must be a DNS_* constant"); RETURN_THROWS(); } } else { From d937df7031affb75743a31bf550b9416579f096a Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Thu, 6 Aug 2020 14:33:44 +0200 Subject: [PATCH 11/15] IPTC reviews --- ext/standard/iptc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c index ec3281eea87c..6e9df19c3006 100644 --- a/ext/standard/iptc.c +++ b/ext/standard/iptc.c @@ -193,7 +193,7 @@ PHP_FUNCTION(iptcembed) } if (iptcdata_len >= SIZE_MAX - sizeof(psheader) - 1025) { - zend_argument_value_error(1, "must be less than %d characters", SIZE_MAX - sizeof(psheader) - 1025); + zend_argument_value_error(1, "is too large"); RETURN_THROWS(); } From c0aea243c1c9561dd5cffd615fa24e3fe28bdde1 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Thu, 6 Aug 2020 14:42:40 +0200 Subject: [PATCH 12/15] Use assertion for user filters --- ext/standard/user_filters.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c index 1095bf5072bb..7c8e02fa28f3 100644 --- a/ext/standard/user_filters.c +++ b/ext/standard/user_filters.c @@ -299,12 +299,7 @@ static php_stream_filter *user_filter_factory_create(const char *filtername, } efree(wildcard); } - if (fdat == NULL) { - zend_throw_error(NULL, "Filter \"%s\" is not in the user-filter map, " - "but user-filter-factory was invoked for it." - "This is a bug, please report it at https://bugs.php.net", filtername); - return NULL; - } + ZEND_ASSERT(fdat); } /* bind the classname to the actual class */ From 8dd10268af29b2276b6fa0218c86d376b94c674f Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Wed, 2 Sep 2020 18:04:52 +0200 Subject: [PATCH 13/15] Revert chown test file change --- ext/standard/tests/file/chown.phpt | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/ext/standard/tests/file/chown.phpt b/ext/standard/tests/file/chown.phpt index 6b737f1924b9..05cd4e4d7d41 100644 --- a/ext/standard/tests/file/chown.phpt +++ b/ext/standard/tests/file/chown.phpt @@ -7,11 +7,7 @@ if(substr(PHP_OS, 0, 3) == "WIN") ?> --FILE-- getMessage() . \PHP_EOL; -} +chown("sjhgfskhagkfdgskjfhgskfsdgfkdsajf", NULL); echo "ALIVE\n"; ?> --EXPECTF-- From ca509e543e7dc67b83cb85cc7709d4fc104370f5 Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Wed, 2 Sep 2020 18:10:54 +0200 Subject: [PATCH 14/15] Revert changed to gethostbyname functions --- ext/standard/dns.c | 12 ++++++------ ext/standard/tests/network/bug68925.phpt | 22 ++++++++-------------- 2 files changed, 14 insertions(+), 20 deletions(-) diff --git a/ext/standard/dns.c b/ext/standard/dns.c index 95271fda62dc..42bc93c41a34 100644 --- a/ext/standard/dns.c +++ b/ext/standard/dns.c @@ -212,8 +212,8 @@ PHP_FUNCTION(gethostbyname) if (hostname_len > MAXFQDNLEN) { /* name too long, protect from CVE-2015-0235 */ - zend_argument_value_error(1, "cannot be longer than %d characters", MAXFQDNLEN); - RETURN_THROWS(); + php_error_docref(NULL, E_WARNING, "Host name cannot be longer than %d characters", MAXFQDNLEN); + RETURN_STRINGL(hostname, hostname_len); } RETURN_STR(php_gethostbyname(hostname)); @@ -234,10 +234,10 @@ PHP_FUNCTION(gethostbynamel) ZEND_PARSE_PARAMETERS_END(); if (hostname_len > MAXFQDNLEN) { - /* name too long, protect from CVE-2015-0235 */ - zend_argument_value_error(1, "cannot be longer than %d characters", MAXFQDNLEN); - RETURN_THROWS(); - } + /* name too long, protect from CVE-2015-0235 */ + php_error_docref(NULL, E_WARNING, "Host name cannot be longer than %d characters", MAXFQDNLEN); + RETURN_FALSE; + } hp = php_network_gethostbyname(hostname); if (!hp) { diff --git a/ext/standard/tests/network/bug68925.phpt b/ext/standard/tests/network/bug68925.phpt index d0faba5c102e..764e13e0eda3 100644 --- a/ext/standard/tests/network/bug68925.phpt +++ b/ext/standard/tests/network/bug68925.phpt @@ -2,18 +2,12 @@ Bug #68925 (CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow) --FILE-- getMessage() . \PHP_EOL; -} -try { - var_dump(gethostbynamel(str_repeat("0", 2501))); -} catch (\ValueError $e) { - echo $e->getMessage() . \PHP_EOL; -} - +var_dump(gethostbyname(str_repeat("0", 2501))); +var_dump(gethostbynamel(str_repeat("0", 2501))); ?> ---EXPECT-- -gethostbyname(): Argument #1 ($hostname) cannot be longer than 255 characters -gethostbynamel(): Argument #1 ($hostname) cannot be longer than 255 characters +--EXPECTF-- +Warning: gethostbyname(): Host name is too long, the limit is %d characters in %s%ebug68925.php on line %d +string(2501) "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" + +Warning: gethostbynamel(): Host name is too long, the limit is %d characters in %s%ebug68925.php on line %d +bool(false) From 438f411ac6231b26586b3e2f012f576ec21a67db Mon Sep 17 00:00:00 2001 From: George Peter Banyard Date: Wed, 2 Sep 2020 19:43:01 +0200 Subject: [PATCH 15/15] Fix warning message in test after partial revert --- ext/standard/tests/network/bug68925.phpt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/standard/tests/network/bug68925.phpt b/ext/standard/tests/network/bug68925.phpt index 764e13e0eda3..fc097e25fb30 100644 --- a/ext/standard/tests/network/bug68925.phpt +++ b/ext/standard/tests/network/bug68925.phpt @@ -6,8 +6,8 @@ var_dump(gethostbyname(str_repeat("0", 2501))); var_dump(gethostbynamel(str_repeat("0", 2501))); ?> --EXPECTF-- -Warning: gethostbyname(): Host name is too long, the limit is %d characters in %s%ebug68925.php on line %d +Warning: gethostbyname(): Host name cannot be longer than %d characters in %s%ebug68925.php on line %d string(2501) "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" -Warning: gethostbynamel(): Host name is too long, the limit is %d characters in %s%ebug68925.php on line %d +Warning: gethostbynamel(): Host name cannot be longer than %d characters in %s%ebug68925.php on line %d bool(false)