Fixed possible GLOBALS variable override when register_globals are ON.

Fixed possible register_globals toggle via parse_str().

diff --git a/ext/standard/string.c b/ext/standard/string.c
index eb72208648f43077cbc81bca3395269b8b228b4c..4cc057312610c7656bba27ef4e91d11a261a5c9c 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4786,7 +4786,6 @@ PHP_FUNCTION(parse_str)
        zval *sarg;
        char *res = NULL;
        int argCount;
-       int old_rg;
 
        argCount = ZEND_NUM_ARGS();
        if (argCount < 1 || argCount > 2 || zend_get_parameters_ex(argCount, &arg, &arrayArg) == FAILURE) {
@@ -4799,19 +4798,18 @@ PHP_FUNCTION(parse_str)
                res = estrndup(Z_STRVAL_P(sarg), Z_STRLEN_P(sarg));
        }
 
-       old_rg = PG(register_globals);
        if (argCount == 1) {
-               PG(register_globals) = 1;
-               sapi_module.treat_data(PARSE_STRING, res, NULL TSRMLS_CC);
+               zval tmp;
+               Z_ARRVAL(tmp) = EG(active_symbol_table);
+
+               sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC);
        } else  {
-               PG(register_globals) = 0;
                /* Clear out the array that was passed in. */
                zval_dtor(*arrayArg);
                array_init(*arrayArg);
                
                sapi_module.treat_data(PARSE_STRING, res, *arrayArg TSRMLS_CC);
        }
-       PG(register_globals) = old_rg;
 }
 /* }}} */
 

diff --git a/main/php_variables.c b/main/php_variables.c
index 3242c0724bd03f9c78bf1ecca23af297097a00a9..e7124700f97e33ad7138c9b11a05a092cb268382 100644 (file)
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -118,6 +118,13 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, zval *track_vars_arra
                zval_dtor(val);
                return;
        }
+
+       /* GLOBALS hijack attempt, reject parameter */
+       if (symtable1 == EG(active_symbol_table) && !strcmp("GLOBALS", var)) {
+               zval_dtor(val);
+               return;
+       }
+
        /* ensure that we don't have spaces or dots in the variable name (not binary safe) */
        for (p=var; *p; p++) {
                switch (*p) {