BugFix #32563

This could have been done in stream_wrapper_register()
without introducing the slight performance hit on
wrapper registration since anyone registering a wrapper
in an extension should know better.

The important thing is that since locate_wrapper makes
the assumption that all schemes will be /^[a-z0-9+.-]+$/i
Anything which registers them should make the same assumption as well.

diff --git a/main/streams/streams.c b/main/streams/streams.c
index 066662c9b6eeda34c4de8033f9c3ec35e67ca193..1e326f220871a8a6b12419b5ffc7c77e5b382e08 100755 (executable)
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1410,7 +1410,18 @@ int php_shutdown_stream_wrappers(int module_number TSRMLS_DC)
 /* API for registering GLOBAL wrappers */
 PHPAPI int php_register_url_stream_wrapper(char *protocol, php_stream_wrapper *wrapper TSRMLS_DC)
 {
-       return zend_hash_add(&url_stream_wrappers_hash, protocol, strlen(protocol), wrapper, sizeof(*wrapper), NULL);
+       int i, protocol_len = strlen(protocol);
+
+       for(i = 0; i < protocol_len; i++) {
+               if (!isalnum((int)protocol[i]) &&
+                       protocol[i] != '+' &&
+                       protocol[i] != '-' &&
+                       protocol[i] != '.') {
+                       return FAILURE;
+               }
+       }
+
+       return zend_hash_add(&url_stream_wrappers_hash, protocol, protocol_len, wrapper, sizeof(*wrapper), NULL);
 }
 
 PHPAPI int php_unregister_url_stream_wrapper(char *protocol TSRMLS_DC)
@@ -1421,6 +1432,17 @@ PHPAPI int php_unregister_url_stream_wrapper(char *protocol TSRMLS_DC)
 /* API for registering VOLATILE wrappers */
 PHPAPI int php_register_url_stream_wrapper_volatile(char *protocol, php_stream_wrapper *wrapper TSRMLS_DC)
 {
+       int i, protocol_len = strlen(protocol);
+
+       for(i = 0; i < protocol_len; i++) {
+               if (!isalnum((int)protocol[i]) &&
+                       protocol[i] != '+' &&
+                       protocol[i] != '-' &&
+                       protocol[i] != '.') {
+                       return FAILURE;
+               }
+       }
+
        if (!FG(stream_wrappers)) {
                php_stream_wrapper tmpwrapper;
 
@@ -1429,7 +1451,7 @@ PHPAPI int php_register_url_stream_wrapper_volatile(char *protocol, php_stream_w
                zend_hash_copy(FG(stream_wrappers), &url_stream_wrappers_hash, NULL, &tmpwrapper, sizeof(php_stream_wrapper));
        }
 
-       return zend_hash_add(FG(stream_wrappers), protocol, strlen(protocol), wrapper, sizeof(*wrapper), NULL);
+       return zend_hash_add(FG(stream_wrappers), protocol, protocol_len, wrapper, sizeof(*wrapper), NULL);
 }
 
 PHPAPI int php_unregister_url_stream_wrapper_volatile(char *protocol TSRMLS_DC)