Skip to content

Commit d0850ab

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-8.0'
* PHP-8.0: Fix #76448: Stack buffer overflow in firebird_info_cb Fix #76449: SIGSEGV in firebird_handle_doer Fix #76450: SIGSEGV in firebird_stmt_execute Fix #76452: Crash while parsing blob data in firebird_fetch_blob Fix #81122: SSRF bypass in FILTER_VALIDATE_URL
2 parents e748dca + 44e7782 commit d0850ab

12 files changed

+151
-4
lines changed

‎ext/filter/logical_filters.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -636,7 +636,9 @@ void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
636636
RETURN_VALIDATION_FAILED
637637
}
638638

639-
if (url->user != NULL && !is_userinfo_valid(url->user)) {
639+
if (url->user != NULL && !is_userinfo_valid(url->user)
640+
|| url->pass != NULL && !is_userinfo_valid(url->pass)
641+
) {
640642
php_url_free(url);
641643
RETURN_VALIDATION_FAILED
642644

‎ext/filter/tests/bug81122.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug #81122 (SSRF bypass in FILTER_VALIDATE_URL)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('filter')) die("skip filter extension not available");
6+
?>
7+
--FILE--
8+
<?php
9+
$urls = [
10+
"https://example.com:\\@test.com/",
11+
"https://user:\\epass@test.com",
12+
"https://user:\\@test.com",
13+
];
14+
foreach ($urls as $url) {
15+
var_dump(filter_var($url, FILTER_VALIDATE_URL));
16+
}
17+
?>
18+
--EXPECT--
19+
bool(false)
20+
bool(false)
21+
bool(false)

‎ext/pdo_firebird/firebird_driver.c

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -626,8 +626,17 @@ static zend_long firebird_handle_doer(pdo_dbh_t *dbh, const zend_string *sql) /*
626626
if (result[0] == isc_info_sql_records) {
627627
unsigned i = 3, result_size = isc_vax_integer(&result[1],2);
628628

629+
if (result_size > sizeof(result)) {
630+
ret = -1;
631+
goto free_statement;
632+
}
629633
while (result[i] != isc_info_end && i < result_size) {
630634
short len = (short)isc_vax_integer(&result[i+1],2);
635+
/* bail out on bad len */
636+
if (len != 1 && len != 2 && len != 4) {
637+
ret = -1;
638+
goto free_statement;
639+
}
631640
if (result[i] != isc_info_req_select_count) {
632641
ret += isc_vax_integer(&result[i+3],len);
633642
}
@@ -905,14 +914,16 @@ static bool firebird_handle_set_attribute(pdo_dbh_t *dbh, zend_long attr, zval *
905914
}
906915
/* }}} */
907916

917+
#define INFO_BUF_LEN 512
918+
908919
/* callback to used to report database server info */
909920
static void firebird_info_cb(void *arg, char const *s) /* {{{ */
910921
{
911922
if (arg) {
912923
if (*(char*)arg) { /* second call */
913-
strcat(arg, " ");
924+
strlcat(arg, " ", INFO_BUF_LEN);
914925
}
915-
strcat(arg, s);
926+
strlcat(arg, s, INFO_BUF_LEN);
916927
}
917928
}
918929
/* }}} */
@@ -923,7 +934,7 @@ static int firebird_handle_get_attribute(pdo_dbh_t *dbh, zend_long attr, zval *v
923934
pdo_firebird_db_handle *H = (pdo_firebird_db_handle *)dbh->driver_data;
924935

925936
switch (attr) {
926-
char tmp[512];
937+
char tmp[INFO_BUF_LEN];
927938

928939
case PDO_ATTR_AUTOCOMMIT:
929940
ZVAL_LONG(val,dbh->auto_commit);

‎ext/pdo_firebird/firebird_statement.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,8 +126,14 @@ static int firebird_stmt_execute(pdo_stmt_t *stmt) /* {{{ */
126126
}
127127
if (result[0] == isc_info_sql_records) {
128128
unsigned i = 3, result_size = isc_vax_integer(&result[1], 2);
129+
if (result_size > sizeof(result)) {
130+
goto error;
131+
}
129132
while (result[i] != isc_info_end && i < result_size) {
130133
short len = (short) isc_vax_integer(&result[i + 1], 2);
134+
if (len != 1 && len != 2 && len != 4) {
135+
goto error;
136+
}
131137
if (result[i] != isc_info_req_select_count) {
132138
affected_rows += isc_vax_integer(&result[i + 3], len);
133139
}
@@ -152,6 +158,7 @@ static int firebird_stmt_execute(pdo_stmt_t *stmt) /* {{{ */
152158
return 1;
153159
} while (0);
154160

161+
error:
155162
RECORD_ERROR(stmt);
156163

157164
return 0;

‎ext/pdo_firebird/tests/bug_76448.data

749 Bytes
Binary file not shown.

‎ext/pdo_firebird/tests/bug_76448.phpt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
Bug #76448 (Stack buffer overflow in firebird_info_cb)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('pdo_firebird')) die("skip podo_firebird extension not available");
6+
if (!extension_loaded('sockets')) die("skip sockets extension not available");
7+
?>
8+
--FILE--
9+
<?php
10+
require_once "payload_server.inc";
11+
12+
$address = run_server(__DIR__ . "/bug_76448.data");
13+
14+
// no need to change the credentials; we're running against a falke server
15+
$dsn = "firebird:dbname=inet://$address/test";
16+
$username = 'SYSDBA';
17+
$password = 'masterkey';
18+
19+
$dbh = new PDO($dsn, $username, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
20+
var_dump($dbh->getAttribute(PDO::ATTR_SERVER_INFO));
21+
?>
22+
--EXPECT--
23+
bool(false)

‎ext/pdo_firebird/tests/bug_76449.data

464 Bytes
Binary file not shown.

‎ext/pdo_firebird/tests/bug_76449.phpt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
Bug #76449 (SIGSEGV in firebird_handle_doer)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('pdo_firebird')) die("skip pdo_firebird extension not available");
6+
if (!extension_loaded('sockets')) die("skip sockets extension not available");
7+
?>
8+
--FILE--
9+
<?php
10+
require_once "payload_server.inc";
11+
12+
$address = run_server(__DIR__ . "/bug_76449.data");
13+
14+
// no need to change the credentials; we're running against a fake server
15+
$dsn = "firebird:dbname=inet://$address/test";
16+
$username = 'SYSDBA';
17+
$password = 'masterkey';
18+
19+
$dbh = new PDO($dsn, $username, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
20+
var_dump($dbh->exec("INSERT INTO test VALUES ('hihi2', 'xxxxx')"));
21+
?>
22+
--EXPECT--
23+
bool(false)

‎ext/pdo_firebird/tests/bug_76450.data

464 Bytes
Binary file not shown.

‎ext/pdo_firebird/tests/bug_76450.phpt

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
--TEST--
2+
Bug #76450 (SIGSEGV in firebird_stmt_execute)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('pdo_firebird')) die("skip pdo_firebird extension not available");
6+
if (!extension_loaded('sockets')) die("skip sockets extension not available");
7+
?>
8+
--FILE--
9+
<?php
10+
require_once "payload_server.inc";
11+
12+
$address = run_server(__DIR__ . "/bug_76450.data");
13+
14+
// no need to change the credentials; we're running against a fake server
15+
$dsn = "firebird:dbname=inet://$address/test";
16+
$username = 'SYSDBA';
17+
$password = 'masterkey';
18+
19+
$dbh = new PDO($dsn, $username, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
20+
$sql = "EXECUTE PROCEDURE test_proc 123";
21+
$query = $dbh->prepare($sql);
22+
try {
23+
$query->execute();
24+
} catch (Exception $ex) {
25+
echo "{$ex->getMessage()}\n";
26+
}
27+
?>
28+
--EXPECT--
29+
SQLSTATE[HY000]: General error

‎ext/pdo_firebird/tests/bug_76452.data

856 Bytes
Binary file not shown.

‎ext/pdo_firebird/tests/bug_76452.phpt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
--TEST--
2+
Bug ##76452 (Crash while parsing blob data in firebird_fetch_blob)
3+
--SKIPIF--
4+
<?php require('skipif.inc'); ?>
5+
--FILE--
6+
<?php
7+
require_once "payload_server.inc";
8+
9+
$address = run_server(__DIR__ . "/bug_76452.data");
10+
11+
// no need to change the credentials; we're running against a falke server
12+
$dsn = "firebird:dbname=inet://$address/test";
13+
$username = 'SYSDBA';
14+
$password = 'masterkey';
15+
16+
$dbh = new PDO($dsn, $username, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
17+
$query = $dbh->prepare("select * from test");
18+
$query->execute();
19+
var_dump($query->fetch());
20+
?>
21+
--EXPECT--
22+
array(4) {
23+
["AAA"]=>
24+
string(4) "hihi"
25+
[0]=>
26+
string(4) "hihi"
27+
["BBBB"]=>
28+
NULL
29+
[1]=>
30+
NULL
31+
}

0 commit comments

Comments
 (0)