limit iconv parameter sizes - workaround for libc bug

diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c
index 582a6778ebec93982d52804fb5baaee08c33f403..57af813dce44a0a189a3787aea0152a6b1ba4658 100644 (file)
--- a/ext/iconv/iconv.c
+++ b/ext/iconv/iconv.c
@@ -230,12 +230,21 @@ static char _generic_superset_name[] = "UCS-4LE";
 #define GENERIC_SUPERSET_NBYTES 4
 /* }}} */
 
+static PHP_INI_MH(OnUpdateStringIconvCharset)
+{
+       if(new_value_length >= ICONV_CSNMAXLEN) {
+               return FAILURE;
+       }
+       OnUpdateString(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC);
+       return SUCCESS;
+}
+
 /* {{{ PHP_INI
  */
 PHP_INI_BEGIN()
-       STD_PHP_INI_ENTRY("iconv.input_encoding",    ICONV_INPUT_ENCODING,    PHP_INI_ALL, OnUpdateString, input_encoding,    zend_iconv_globals, iconv_globals)
-       STD_PHP_INI_ENTRY("iconv.output_encoding",   ICONV_OUTPUT_ENCODING,   PHP_INI_ALL, OnUpdateString, output_encoding,   zend_iconv_globals, iconv_globals)
-       STD_PHP_INI_ENTRY("iconv.internal_encoding", ICONV_INTERNAL_ENCODING, PHP_INI_ALL, OnUpdateString, internal_encoding, zend_iconv_globals, iconv_globals)
+       STD_PHP_INI_ENTRY("iconv.input_encoding",    ICONV_INPUT_ENCODING,    PHP_INI_ALL, OnUpdateStringIconvCharset, input_encoding,    zend_iconv_globals, iconv_globals)
+       STD_PHP_INI_ENTRY("iconv.output_encoding",   ICONV_OUTPUT_ENCODING,   PHP_INI_ALL, OnUpdateStringIconvCharset, output_encoding,   zend_iconv_globals, iconv_globals)
+       STD_PHP_INI_ENTRY("iconv.internal_encoding", ICONV_INTERNAL_ENCODING, PHP_INI_ALL, OnUpdateStringIconvCharset, internal_encoding, zend_iconv_globals, iconv_globals)
 PHP_INI_END()
 /* }}} */
 
@@ -1921,7 +1930,7 @@ static void _php_iconv_show_error(php_iconv_err_t err, const char *out_charset,
 PHP_FUNCTION(iconv_strlen)
 {
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        char *str;
        int str_len; 
 
@@ -1936,6 +1945,11 @@ PHP_FUNCTION(iconv_strlen)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        err = _php_iconv_strlen(&retval, str, str_len, charset); 
        _php_iconv_show_error(err, GENERIC_SUPERSET_NAME, charset TSRMLS_CC);
        if (err == PHP_ICONV_ERR_SUCCESS) {
@@ -1951,7 +1965,7 @@ PHP_FUNCTION(iconv_strlen)
 PHP_FUNCTION(iconv_substr)
 {
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        char *str;
        int str_len; 
        long offset, length;
@@ -1968,6 +1982,11 @@ PHP_FUNCTION(iconv_substr)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        if (ZEND_NUM_ARGS() < 3) {
                length = str_len; 
        }
@@ -1993,7 +2012,7 @@ PHP_FUNCTION(iconv_substr)
 PHP_FUNCTION(iconv_strpos)
 {
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        char *haystk;
        int haystk_len; 
        char *ndl;
@@ -2013,6 +2032,11 @@ PHP_FUNCTION(iconv_strpos)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        if (offset < 0) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset not contained in string");
                RETURN_FALSE;
@@ -2039,7 +2063,7 @@ PHP_FUNCTION(iconv_strpos)
 PHP_FUNCTION(iconv_strrpos)
 {
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        char *haystk;
        int haystk_len; 
        char *ndl;
@@ -2061,6 +2085,11 @@ PHP_FUNCTION(iconv_strrpos)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        err = _php_iconv_strpos(&retval, haystk, haystk_len, ndl, ndl_len,
                                -1, charset); 
        _php_iconv_show_error(err, GENERIC_SUPERSET_NAME, charset TSRMLS_CC);
@@ -2117,6 +2146,11 @@ PHP_FUNCTION(iconv_mime_encode)
                }
 
                if (zend_hash_find(Z_ARRVAL_P(pref), "input-charset", sizeof("input-charset"), (void **)&ppval) == SUCCESS) {
+                       if (Z_STRLEN_PP(ppval) >= ICONV_CSNMAXLEN) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+                               RETURN_FALSE;
+                       }
+
                        if (Z_TYPE_PP(ppval) == IS_STRING && Z_STRLEN_PP(ppval) > 0) {
                                in_charset = Z_STRVAL_PP(ppval);
                        }
@@ -2124,6 +2158,11 @@ PHP_FUNCTION(iconv_mime_encode)
 
 
                if (zend_hash_find(Z_ARRVAL_P(pref), "output-charset", sizeof("output-charset"), (void **)&ppval) == SUCCESS) {
+                       if (Z_STRLEN_PP(ppval) >= ICONV_CSNMAXLEN) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+                               RETURN_FALSE;
+                       }
+
                        if (Z_TYPE_PP(ppval) == IS_STRING && Z_STRLEN_PP(ppval) > 0) {
                                out_charset = Z_STRVAL_PP(ppval);
                        }
@@ -2188,7 +2227,7 @@ PHP_FUNCTION(iconv_mime_encode)
 PHP_FUNCTION(iconv_mime_decode)
 {
        char *encoded_str;
-       int encoded_str_len;
+       int encoded_str_len = 0;
        char *charset;
        int charset_len;
        long mode = 0;
@@ -2205,6 +2244,11 @@ PHP_FUNCTION(iconv_mime_decode)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        err = _php_iconv_mime_decode(&retval, encoded_str, encoded_str_len, charset, NULL, mode);
        _php_iconv_show_error(err, charset, "???" TSRMLS_CC);
 
@@ -2228,7 +2272,7 @@ PHP_FUNCTION(iconv_mime_decode_headers)
        const char *encoded_str;
        int encoded_str_len;
        char *charset;
-       int charset_len;
+       int charset_len = 0;
        long mode = 0;
        
        php_iconv_err_t err = PHP_ICONV_ERR_SUCCESS;
@@ -2241,6 +2285,11 @@ PHP_FUNCTION(iconv_mime_decode_headers)
                RETURN_FALSE;
        }
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        array_init(return_value);
 
        while (encoded_str_len > 0) {
@@ -2323,13 +2372,18 @@ PHP_NAMED_FUNCTION(php_if_iconv)
 {
        char *in_charset, *out_charset, *in_buffer, *out_buffer;
        size_t out_len;
-       int in_charset_len, out_charset_len, in_buffer_len;
+       int in_charset_len = 0, out_charset_len = 0, in_buffer_len;
        php_iconv_err_t err;
        
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sss",
                &in_charset, &in_charset_len, &out_charset, &out_charset_len, &in_buffer, &in_buffer_len) == FAILURE)
                return;
 
+       if (in_charset_len >= ICONV_CSNMAXLEN || out_charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        err = php_iconv_string(in_buffer, (size_t)in_buffer_len,
                &out_buffer, &out_len, out_charset, in_charset);
        _php_iconv_show_error(err, out_charset, in_charset TSRMLS_CC); 
@@ -2346,11 +2400,16 @@ PHP_NAMED_FUNCTION(php_if_iconv)
 PHP_FUNCTION(iconv_set_encoding)
 {
        char *type, *charset;
-       int type_len, charset_len, retval;
+       int type_len, charset_len =0, retval;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &type, &type_len, &charset, &charset_len) == FAILURE)
                return;
 
+       if (charset_len >= ICONV_CSNMAXLEN) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN);
+               RETURN_FALSE;
+       }
+
        if(!strcasecmp("input_encoding", type)) {
                retval = zend_alter_ini_entry("iconv.input_encoding", sizeof("iconv.input_encoding"), charset, charset_len, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
        } else if(!strcasecmp("output_encoding", type)) {
@@ -2744,6 +2803,10 @@ static php_stream_filter *php_iconv_stream_filter_factory_create(const char *nam
        ++to_charset;
        to_charset_len = strlen(to_charset);
 
+       if (from_charset_len >= ICONV_CSNMAXLEN || to_charset_len >= ICONV_CSNMAXLEN) {
+               return NULL;
+       }
+
        if (NULL == (inst = pemalloc(sizeof(php_iconv_stream_filter), persistent))) {
                return NULL;
        }

diff --git a/ext/iconv/php_iconv.h b/ext/iconv/php_iconv.h
index e79f1d8d08fd473a83cd214a933b449de31965bf..383f232d26d63b025dc8e16c74e4657d664920f3 100644 (file)
--- a/ext/iconv/php_iconv.h
+++ b/ext/iconv/php_iconv.h
@@ -78,6 +78,10 @@ ZEND_END_MODULE_GLOBALS(iconv)
 #define ICONV_OUTPUT_ENCODING "ISO-8859-1"
 #define ICONV_INTERNAL_ENCODING "ISO-8859-1" 
 
+#ifndef ICONV_CSNMAXLEN
+#define ICONV_CSNMAXLEN 64
+#endif
+
 /* {{{ typedef enum php_iconv_err_t */
 typedef enum _php_iconv_err_t {
        PHP_ICONV_ERR_SUCCESS           = SUCCESS,