MFH: Fixed bug #32936 (http redirects URLs are not checked for control chars).

diff --git a/NEWS b/NEWS
index 353ec0f0474b22c5ccbf772b2f68451beed922e0..ebca9047be43962b71b77c2176568a322552d229 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,7 @@ PHP                                                                        NEWS
 - Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey)
 - Fixed bug #32956 (mysql_bind_result doesn't support MYSQL_TYPE_NULL). (Georg)
 - Fixed bug #32947 (Incorrect option for mysqli default password). (Georg)
+- Fixed bug #32936 (http redirects URLs are not checked for control chars). (Ilia)
 - Fixed bug #32930 (class extending DOMDocument doesn't clone properly). (Rob)
 - Fixed bug #32852 (Crash with singleton and __destruct when
   zend.ze1_compatibility_mode = On). (Dmitry)

diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
index 892fe9bd5ea66116e948b42e704faf55acc58886..ae4c664a3f0e1679079f3fcb361da3193cea9eac 100644 (file)
--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@ -517,6 +517,34 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
                        } else {
                                strlcpy(new_path, location, sizeof(new_path));
                        }
+
+                       php_url_free(resource);
+                       /* check for invalid redirection URLs */
+                       if ((resource = php_url_parse(new_path)) == NULL) {
+                               php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Invalid redirect url! %s", new_path);
+                               goto out;
+                       }
+
+#define CHECK_FOR_CNTRL_CHARS(val) {   \
+       if (val) {      \
+               unsigned char *s, *e;   \
+               int l;  \
+               l = php_url_decode(val, strlen(val));   \
+               s = val; e = s + l;     \
+               while (s < e) { \
+                       if (iscntrl(*s)) {      \
+                               php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Invalid redirect url! %s", new_path); \
+                               goto out;       \
+                       }       \
+                       s++;    \
+               }       \
+       }       \
+}      \
+                       /* check for control characters in login, password & path */
+                       CHECK_FOR_CNTRL_CHARS(resource->user)
+                       CHECK_FOR_CNTRL_CHARS(resource->pass)
+                       CHECK_FOR_CNTRL_CHARS(resource->path)
+
                        stream = php_stream_url_wrap_http_ex(NULL, new_path, mode, options, opened_path, context, --redirect_max, 0 STREAMS_CC TSRMLS_CC);
                        if (stream && stream->wrapperdata)      {
                                entryp = &entry;