limit iconv parameter sizes - workaround for glibc bug

diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c
index 3c2f447416dca79b0e3f88a02187173aa5c20c77..2c6906880264fbce578df31bd71f07b23eedfd9b 100644 (file)
--- a/ext/iconv/iconv.c
+++ b/ext/iconv/iconv.c
@@ -233,12 +233,21 @@ static char _generic_superset_name[] = "UCS-4LE";
 #define GENERIC_SUPERSET_NBYTES 4
 /* }}} */
 
+static PHP_INI_MH(OnUpdateStringIconvCharset)
+{
+       if(new_value_length >= ICONV_CSNMAXLEN) {
+               return FAILURE;
+       }
+       OnUpdateString(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC);
+       return SUCCESS;
+}
+
 /* {{{ PHP_INI
  */
 PHP_INI_BEGIN()
-       STD_PHP_INI_ENTRY("iconv.input_encoding",    ICONV_INPUT_ENCODING,    PHP_INI_ALL, OnUpdateString, input_encoding,    zend_iconv_globals, iconv_globals)
-       STD_PHP_INI_ENTRY("iconv.output_encoding",   ICONV_OUTPUT_ENCODING,   PHP_INI_ALL, OnUpdateString, output_encoding,   zend_iconv_globals, iconv_globals)
-       STD_PHP_INI_ENTRY("iconv.internal_encoding", ICONV_INTERNAL_ENCODING, PHP_INI_ALL, OnUpdateString, internal_encoding, zend_iconv_globals, iconv_globals)
+       STD_PHP_INI_ENTRY("iconv.input_encoding",    ICONV_INPUT_ENCODING,    PHP_INI_ALL, OnUpdateStringIconvCharset, input_encoding,    zend_iconv_globals, iconv_globals)
+       STD_PHP_INI_ENTRY("iconv.output_encoding",   ICONV_OUTPUT_ENCODING,   PHP_INI_ALL, OnUpdateStringIconvCharset, output_encoding,   zend_iconv_globals, iconv_globals)
+       STD_PHP_INI_ENTRY("iconv.internal_encoding", ICONV_INTERNAL_ENCODING, PHP_INI_ALL, OnUpdateStringIconvCharset, internal_encoding, zend_iconv_globals, iconv_globals)
 PHP_INI_END()
 /* }}} */
 
@@ -1858,7 +1867,7 @@ static void _php_iconv_show_error(php_iconv_err_t err, const char *out_charset,
 PHP_FUNCTION(iconv_strlen)
 {
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        char *str;
        int str_len; 
 
@@ -1873,6 +1882,11 @@ PHP_FUNCTION(iconv_strlen)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        err = _php_iconv_strlen(&retval, str, str_len, charset); 
        _php_iconv_show_error(err, GENERIC_SUPERSET_NAME, charset TSRMLS_CC);
        if (err == PHP_ICONV_ERR_SUCCESS) {
@@ -1888,7 +1902,7 @@ PHP_FUNCTION(iconv_strlen)
 PHP_FUNCTION(iconv_substr)
 {
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        char *str;
        int str_len; 
        long offset, length;
@@ -1905,6 +1919,11 @@ PHP_FUNCTION(iconv_substr)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        if (ZEND_NUM_ARGS() < 3) {
                length = str_len; 
        }
@@ -1925,7 +1944,7 @@ PHP_FUNCTION(iconv_substr)
 PHP_FUNCTION(iconv_strpos)
 {
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        char *haystk;
        int haystk_len; 
        char *ndl;
@@ -1945,6 +1964,11 @@ PHP_FUNCTION(iconv_strpos)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        if (offset < 0) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset not contained in string.");
                RETURN_FALSE;
@@ -1971,7 +1995,7 @@ PHP_FUNCTION(iconv_strpos)
 PHP_FUNCTION(iconv_strrpos)
 {
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        char *haystk;
        int haystk_len; 
        char *ndl;
@@ -1993,6 +2017,11 @@ PHP_FUNCTION(iconv_strrpos)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        err = _php_iconv_strpos(&retval, haystk, haystk_len, ndl, ndl_len,
                                -1, charset); 
        _php_iconv_show_error(err, GENERIC_SUPERSET_NAME, charset TSRMLS_CC);
@@ -2049,6 +2078,11 @@ PHP_FUNCTION(iconv_mime_encode)
                }
 
                if (zend_hash_find(Z_ARRVAL_P(pref), "input-charset", sizeof("input-charset"), (void **)&ppval) == SUCCESS) {
+                       if (Z_STRLEN_PP(ppval) >= ICONV_CSNMAXLEN) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+                               RETURN_FALSE;
+                       }
+
                        if (Z_TYPE_PP(ppval) == IS_STRING && Z_STRLEN_PP(ppval) > 0) {
                                in_charset = Z_STRVAL_PP(ppval);
                        }
@@ -2056,6 +2090,11 @@ PHP_FUNCTION(iconv_mime_encode)
 
 
                if (zend_hash_find(Z_ARRVAL_P(pref), "output-charset", sizeof("output-charset"), (void **)&ppval) == SUCCESS) {
+                       if (Z_STRLEN_PP(ppval) >= ICONV_CSNMAXLEN) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+                               RETURN_FALSE;
+                       }
+
                        if (Z_TYPE_PP(ppval) == IS_STRING && Z_STRLEN_PP(ppval) > 0) {
                                out_charset = Z_STRVAL_PP(ppval);
                        }
@@ -2120,7 +2159,7 @@ PHP_FUNCTION(iconv_mime_encode)
 PHP_FUNCTION(iconv_mime_decode)
 {
        char *encoded_str;
-       int encoded_str_len;
+       int encoded_str_len = 0;
        char *charset;
        int charset_len;
        long mode = 0;
@@ -2137,6 +2176,11 @@ PHP_FUNCTION(iconv_mime_decode)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        err = _php_iconv_mime_decode(&retval, encoded_str, encoded_str_len, charset, NULL, mode);
        _php_iconv_show_error(err, charset, "???" TSRMLS_CC);
 
@@ -2160,7 +2204,7 @@ PHP_FUNCTION(iconv_mime_decode_headers)
        const char *encoded_str;
        int encoded_str_len;
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        long mode = 0;
        
        php_iconv_err_t err = PHP_ICONV_ERR_SUCCESS;
@@ -2173,6 +2217,11 @@ PHP_FUNCTION(iconv_mime_decode_headers)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        array_init(return_value);
 
        while (encoded_str_len > 0) {
@@ -2255,13 +2304,18 @@ PHP_NAMED_FUNCTION(php_if_iconv)
 {
        char *in_charset, *out_charset, *in_buffer, *out_buffer;
        size_t out_len;
-       int in_charset_len, out_charset_len, in_buffer_len;
+       int in_charset_len = 0, out_charset_len = 0, in_buffer_len;
        php_iconv_err_t err;
        
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sss",
                &in_charset, &in_charset_len, &out_charset, &out_charset_len, &in_buffer, &in_buffer_len) == FAILURE)
                return;
 
+       if (in_charset_len >= ICONV_CSNMAXLEN || out_charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        err = php_iconv_string(in_buffer, (size_t)in_buffer_len,
                &out_buffer, &out_len, out_charset, in_charset);
        _php_iconv_show_error(err, out_charset, in_charset TSRMLS_CC); 
@@ -2330,11 +2384,16 @@ PHP_FUNCTION(ob_iconv_handler)
 PHP_FUNCTION(iconv_set_encoding)
 {
        char *type, *charset;
-       int type_len, charset_len, retval;
+       int type_len, charset_len =0, retval;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &type, &type_len, &charset, &charset_len) == FAILURE)
                return;
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        if(!strcasecmp("input_encoding", type)) {
                retval = zend_alter_ini_entry("iconv.input_encoding", sizeof("iconv.input_encoding"), charset, charset_len, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
        } else if(!strcasecmp("output_encoding", type)) {
@@ -2726,6 +2785,10 @@ static php_stream_filter *php_iconv_stream_filter_factory_create(const char *nam
        ++to_charset;
        to_charset_len = strlen(to_charset);
 
+       if (from_charset_len >= ICONV_CSNMAXLEN || to_charset_len >= ICONV_CSNMAXLEN) {
+               return NULL;
+       }
+
        if (NULL == (inst = pemalloc(sizeof(php_iconv_stream_filter), persistent))) {
                return NULL;
        }

diff --git a/ext/iconv/php_iconv.h b/ext/iconv/php_iconv.h
index a11defd0aaa30aeff3c798d769a26c6cfc1d5401..25c9990824e9f028eeecb3f0c0891a840a2d48ca 100644 (file)
--- a/ext/iconv/php_iconv.h
+++ b/ext/iconv/php_iconv.h
@@ -79,6 +79,10 @@ ZEND_END_MODULE_GLOBALS(iconv)
 #define ICONV_OUTPUT_ENCODING "ISO-8859-1"
 #define ICONV_INTERNAL_ENCODING "ISO-8859-1" 
 
+#ifndef ICONV_CSNMAXLEN
+#define ICONV_CSNMAXLEN 64
+#endif
+
 /* {{{ typedef enum php_iconv_err_t */
 typedef enum _php_iconv_err_t {
        PHP_ICONV_ERR_SUCCESS           = SUCCESS,