Fixed XSS inside phpinfo() with long inputs.

diff --git a/NEWS b/NEWS
index 455314d65f74ba67a004011ffce706e72283dab0..ed0300a17082aacc67a34ad4b152f09cad4596d4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Mar 2006, PHP 5.1.3RC2
+- Fixed XSS inside phpinfo() with long inputs. (Ilia)
 - Check 2nd parameter of tempnam() against path components. (Ilia)
 - Fixed Apache2 SAPIs header handler modifying header strings. (Mike)
 - Allowed 'auto_globals_jit' work together with 'register_argc_argv'. (Dmitry)

diff --git a/ext/standard/info.c b/ext/standard/info.c
index e99a6145d61ee767940ee3f976a9a397a47a61e4..840d357c8ba132d8ef3547201f15fd072c8e87d4 100644 (file)
--- a/ext/standard/info.c
+++ b/ext/standard/info.c
@@ -58,6 +58,21 @@ ZEND_EXTERN_MODULE_GLOBALS(iconv)
 
 PHPAPI extern char *php_ini_opened_path;
 PHPAPI extern char *php_ini_scanned_files;
+       
+static int php_info_write_wrapper(const char *str, uint str_length)
+{
+       TSRMLS_FETCH();
+
+       int new_len, written;
+       char *elem_esc = php_escape_html_entities((char *)str, str_length, &new_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
+
+       written = php_body_write(elem_esc, new_len TSRMLS_CC);
+
+       efree(elem_esc);
+
+       return written;
+}
+
 
 /* {{{ _display_module_info
  */
@@ -135,30 +150,13 @@ static void php_print_gpcse_array(char *name, uint name_length TSRMLS_DC)
                                PUTS(" => ");
                        }
                        if (Z_TYPE_PP(tmp) == IS_ARRAY) {
-                               zval *tmp3;
-
-                               MAKE_STD_ZVAL(tmp3);
-
                                if (!sapi_module.phpinfo_as_text) {
                                        PUTS("<pre>");
-                               }
-                               php_start_ob_buffer(NULL, 4096, 1 TSRMLS_CC);
-                               
-                               zend_print_zval_r(*tmp, 0 TSRMLS_CC);
-                               
-                               php_ob_get_buffer(tmp3 TSRMLS_CC);
-                               php_end_ob_buffer(0, 0 TSRMLS_CC);
-                               
-                               if (!sapi_module.phpinfo_as_text) {
-                                       elem_esc = php_info_html_esc(Z_STRVAL_P(tmp3) TSRMLS_CC);
-                                       PUTS(elem_esc);
-                                       efree(elem_esc);
+                                       zend_print_zval_ex((zend_write_func_t) php_info_write_wrapper, *tmp, 0 TSRMLS_CC);
                                        PUTS("</pre>");
                                } else {
-                                       PUTS(Z_STRVAL_P(tmp3));
+                                       zend_print_zval_r(*tmp, 0 TSRMLS_CC);
                                }
-                               zval_ptr_dtor(&tmp3);
-
                        } else if (Z_TYPE_PP(tmp) != IS_STRING) {
                                tmp2 = **tmp;
                                zval_copy_ctor(&tmp2);