- Fixed bug #62205 (php-fpm segfaults (null passed to strstr))

diff --git a/NEWS b/NEWS
index d031c3c0d466471120f2c14a3950abf666e8bfc8..42eb5b464ea85b7bf8d9a6ffb1e871d23166c2e6 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -23,6 +23,7 @@ PHP                                                                        NEWS
   . Fixed bug #62160 (Add process.priority to set nice(2) priorities). (fat)
   . Fixed bug #61218 (FPM drops connection while receiving some binary values
     in FastCGI requests). (fat)
+  . Fixed bug #62205 (php-fpm segfaults (null passed to strstr)). (fat)
 
 - Intl:
   . Fixed bug #62083 (grapheme_extract() memory leaks). (Gustavo)

diff --git a/sapi/fpm/fpm/fpm_php.c b/sapi/fpm/fpm/fpm_php.c
index 840eec73efbae3ff9a953da54f6e783e150d14a6..cd4d3aef3a330cc8fb146351c91a3f2999c5e39e 100644 (file)
--- a/sapi/fpm/fpm/fpm_php.c
+++ b/sapi/fpm/fpm/fpm_php.c
@@ -257,3 +257,41 @@ int fpm_php_limit_extensions(char *path) /* {{{ */
        return 1; /* extension not found: not allowed  */
 }
 /* }}} */
+
+char* fpm_php_get_string_from_table(char *table, char *key TSRMLS_DC) /* {{{ */
+{
+       zval **data, **tmp;
+       char *string_key;
+       uint string_len;
+       ulong num_key;
+       if (!table || !key) {
+               return NULL;
+       }
+
+       /* inspired from ext/standard/info.c */
+
+       zend_is_auto_global(table, strlen(table) TSRMLS_CC);
+
+       /* find the table and ensure it's an array */
+       if (zend_hash_find(&EG(symbol_table), table, strlen(table) + 1, (void **) &data) == SUCCESS && Z_TYPE_PP(data) == IS_ARRAY) {
+
+               /* reset the internal pointer */
+               zend_hash_internal_pointer_reset(Z_ARRVAL_PP(data));
+
+               /* parse the array to look for our key */
+               while (zend_hash_get_current_data(Z_ARRVAL_PP(data), (void **) &tmp) == SUCCESS) {
+                       /* ensure the key is a string */
+                       if (zend_hash_get_current_key_ex(Z_ARRVAL_PP(data), &string_key, &string_len, &num_key, 0, NULL) == HASH_KEY_IS_STRING) {
+                               /* compare to our key */
+                               if (!strncmp(string_key, key, string_len)) {
+                                       return Z_STRVAL_PP(tmp);
+                               }
+                       }
+                       zend_hash_move_forward(Z_ARRVAL_PP(data));
+               }
+       }
+
+       return NULL;
+}
+/* }}} */
+

diff --git a/sapi/fpm/fpm/fpm_php.h b/sapi/fpm/fpm/fpm_php.h
index a2c7ed318a092bf208068ec23c9474a33627103e..d6054737d67a9832ec3755178c52eafa24466bd9 100644 (file)
--- a/sapi/fpm/fpm/fpm_php.h
+++ b/sapi/fpm/fpm/fpm_php.h
@@ -44,6 +44,7 @@ void fpm_php_soft_quit();
 int fpm_php_init_main();
 int fpm_php_apply_defines_ex(struct key_value_s *kv, int mode);
 int fpm_php_limit_extensions(char *path);
+char* fpm_php_get_string_from_table(char *table, char *key TSRMLS_DC);
 
 #endif
 

diff --git a/sapi/fpm/fpm/fpm_status.c b/sapi/fpm/fpm/fpm_status.c
index e64a645b2d076ed0a5934cab4190eb177f1b171e..3b09d3b8959809e74a395cf8e3a64d2157933802 100644 (file)
--- a/sapi/fpm/fpm/fpm_status.c
+++ b/sapi/fpm/fpm/fpm_status.c
@@ -14,6 +14,7 @@
 #include "zlog.h"
 #include "fpm_atomic.h"
 #include "fpm_conf.h"
+#include "fpm_php.h"
 #include <ext/standard/html.h>
 
 static char *fpm_status_uri = NULL;
@@ -125,13 +126,13 @@ int fpm_status_handle_request(TSRMLS_D) /* {{{ */
                }
 
                /* full status ? */
-               full = SG(request_info).request_uri && strstr(SG(request_info).query_string, "full");
+               full = (fpm_php_get_string_from_table("_GET", "full" TSRMLS_CC) != NULL);
                short_syntax = short_post = NULL;
                full_separator = full_pre = full_syntax = full_post = NULL;
                encode = 0;
 
                /* HTML */
-               if (SG(request_info).query_string && strstr(SG(request_info).query_string, "html")) {
+               if (fpm_php_get_string_from_table("_GET", "html" TSRMLS_CC)) {
                        sapi_add_header_ex(ZEND_STRL("Content-Type: text/html"), 1, 1 TSRMLS_CC);
                        time_format = "%d/%b/%Y:%H:%M:%S %z";
                        encode = 1;
@@ -205,7 +206,7 @@ int fpm_status_handle_request(TSRMLS_D) /* {{{ */
                        }
 
                /* XML */
-               } else if (SG(request_info).request_uri && strstr(SG(request_info).query_string, "xml")) {
+               } else if (fpm_php_get_string_from_table("_GET", "xml" TSRMLS_CC)) {
                        sapi_add_header_ex(ZEND_STRL("Content-Type: text/xml"), 1, 1 TSRMLS_CC);
                        time_format = "%s";
                        encode = 1;
@@ -256,7 +257,7 @@ int fpm_status_handle_request(TSRMLS_D) /* {{{ */
                                }
 
                        /* JSON */
-               } else if (SG(request_info).request_uri && strstr(SG(request_info).query_string, "json")) {
+               } else if (fpm_php_get_string_from_table("_GET", "json" TSRMLS_CC)) {
                        sapi_add_header_ex(ZEND_STRL("Content-Type: application/json"), 1, 1 TSRMLS_CC);
                        time_format = "%s";