- invalid filter id should not return unsafe values

diff --git a/ext/filter/filter.c b/ext/filter/filter.c
index 49c79b01d2d1e9b615d2e6a09478e96ff1bc921a..42c058f43ba9c30bc974dc0d3d95603f2c87f2df 100644 (file)
--- a/ext/filter/filter.c
+++ b/ext/filter/filter.c
@@ -653,6 +653,11 @@ static void php_filter_array_handler(zval *input, zval **op, zval *return_value
                                zval_dtor(return_value);
                                RETURN_FALSE;
                        }
+                       if (arg_key_len < 2) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty keys are not allowed in the definition array");
+                               zval_dtor(return_value);
+                               RETURN_FALSE;
+                       }
                        if (zend_hash_find(Z_ARRVAL_P(input), arg_key, arg_key_len, (void **)&tmp) != SUCCESS) {
                                add_assoc_null_ex(return_value, arg_key, arg_key_len);
                        } else {
@@ -688,6 +693,10 @@ PHP_FUNCTION(filter_input)
                return;
        }
 
+       if (!PHP_FILTER_ID_EXISTS(filter)) {
+               RETURN_FALSE;
+       }
+
        input = php_filter_get_storage(fetch_from TSRMLS_CC);
 
        if (!input || !HASH_OF(input) || zend_hash_find(HASH_OF(input), var, var_len + 1, (void **)&tmp) != SUCCESS) {
@@ -734,6 +743,10 @@ PHP_FUNCTION(filter_var)
                return;
        }
 
+       if (!PHP_FILTER_ID_EXISTS(filter)) {
+               RETURN_FALSE;
+       }
+
        *return_value = *data;
        zval_copy_ctor(data);
 
@@ -753,6 +766,11 @@ PHP_FUNCTION(filter_input_array)
                return;
        }
 
+       if (op && ( (Z_TYPE_PP(op) == IS_LONG && !PHP_FILTER_ID_EXISTS(Z_LVAL_PP(op)))
+               || Z_TYPE_PP(op) != IS_ARRAY)) {
+               RETURN_FALSE;
+       }
+
        array_input = php_filter_get_storage(fetch_from TSRMLS_CC);
 
        if (!array_input || !HASH_OF(array_input)) {
@@ -788,6 +806,11 @@ PHP_FUNCTION(filter_var_array)
                return;
        }
 
+       if (op && ( (Z_TYPE_PP(op) == IS_LONG && !PHP_FILTER_ID_EXISTS(Z_LVAL_PP(op)))
+               || Z_TYPE_PP(op) != IS_ARRAY)) {
+               RETURN_FALSE;
+       }
+
        php_filter_array_handler(array_input, op, return_value TSRMLS_CC);
 }
 /* }}} */

diff --git a/ext/filter/filter_private.h b/ext/filter/filter_private.h
index d782c2dfbf3a994db3409884d8cc18dd352c65d2..af3aef4fe4be362fe266bb468da54d35acd67dab 100644 (file)
--- a/ext/filter/filter_private.h
+++ b/ext/filter/filter_private.h
@@ -62,6 +62,7 @@
 #define FILTER_VALIDATE_URL           0x0111
 #define FILTER_VALIDATE_EMAIL         0x0112
 #define FILTER_VALIDATE_IP            0x0113
+#define FILTER_VALIDATE_LAST          0x0113
 
 #define FILTER_VALIDATE_ALL           0x0100
 
@@ -76,11 +77,17 @@
 #define FILTER_SANITIZE_NUMBER_INT    0x0207
 #define FILTER_SANITIZE_NUMBER_FLOAT  0x0208
 #define FILTER_SANITIZE_MAGIC_QUOTES  0x0209
+#define FILTER_SANITIZE_LAST          0x0209
 
 #define FILTER_SANITIZE_ALL           0x0200
 
 #define FILTER_CALLBACK               0x0400
 
+#define PHP_FILTER_ID_EXISTS(id) \
+((id >= FILTER_SANITIZE_ALL && id <= FILTER_SANITIZE_LAST) \
+|| (id >= FILTER_VALIDATE_ALL && id <= FILTER_VALIDATE_LAST) \
+|| id == FILTER_CALLBACK)
+
 #define PHP_FILTER_TRIM_DEFAULT(p, len, end) { \
        while (*p == ' ' || *p == '\t' || *p == '\r' || *p == '\v') { \
                p++; \

diff --git a/ext/filter/tests/010.phpt b/ext/filter/tests/010.phpt
index b1cf124f2488a43a8eac664029bb77dd73cb06e6..ba6dea19eaacea37e9f7361579dceb2985cb0c97 100644 (file)
--- a/ext/filter/tests/010.phpt
+++ b/ext/filter/tests/010.phpt
@@ -55,6 +55,6 @@ NULL
 string(1) "1"
 string(1) "1"
 string(1) "1"
-string(1) "1"
-string(1) "1"
+bool(false)
+bool(false)
 Done

diff --git a/ext/filter/tests/039.phpt b/ext/filter/tests/039.phpt
index 8b2d31e213c4ee9591f5d4c40357ca334a45cf52..ae883db3e3251426027b08418ec29d869f5d7dd4 100644 (file)
--- a/ext/filter/tests/039.phpt
+++ b/ext/filter/tests/039.phpt
@@ -5,6 +5,7 @@ filter_var_array() and different arguments
 --FILE--
 <?php
 
+echo "-- (1)\n";
 var_dump(filter_var_array(NULL));
 var_dump(filter_var_array(array()));
 var_dump(filter_var_array(array(1,"blah"=>"hoho")));
@@ -12,19 +13,24 @@ var_dump(filter_var_array(array(), -1));
 var_dump(filter_var_array(array(), 1000000));
 var_dump(filter_var_array(array(), ""));
 
+echo "-- (2)\n";
 var_dump(filter_var_array(array(""=>""), -1));
 var_dump(filter_var_array(array(""=>""), 1000000));
 var_dump(filter_var_array(array(""=>""), ""));
 
+echo "-- (3)\n";
 var_dump(filter_var_array(array("aaa"=>"bbb"), -1));
 var_dump(filter_var_array(array("aaa"=>"bbb"), 1000000));
 var_dump(filter_var_array(array("aaa"=>"bbb"), ""));
 
+echo "-- (4)\n";
 var_dump(filter_var_array(array(), new stdclass));
 var_dump(filter_var_array(array(), array()));
 var_dump(filter_var_array(array(), array("var_name"=>1)));
 var_dump(filter_var_array(array(), array("var_name"=>-1)));
 var_dump(filter_var_array(array("var_name"=>""), array("var_name"=>-1)));
+
+echo "-- (5)\n";
 var_dump(filter_var_array(array("var_name"=>""), array("var_name"=>-1, "asdas"=>"asdasd", "qwe"=>"rty", ""=>"")));
 var_dump(filter_var_array(array("asdas"=>"text"), array("var_name"=>-1, "asdas"=>"asdasd", "qwe"=>"rty", ""=>"")));
 
@@ -44,6 +50,8 @@ var_dump($a, $b);
 echo "Done\n";
 ?>
 --EXPECTF--    
+-- (1)
+
 Warning: filter_var_array() expects parameter 1 to be array, null given in %s on line %d
 NULL
 array(0) {
@@ -54,30 +62,19 @@ array(2) {
   ["blah"]=>
   string(4) "hoho"
 }
-array(0) {
-}
-array(0) {
-}
 bool(false)
-array(1) {
-  [""]=>
-  string(0) ""
-}
-array(1) {
-  [""]=>
-  string(0) ""
-}
 bool(false)
-array(1) {
-  ["aaa"]=>
-  string(3) "bbb"
-}
-array(1) {
-  ["aaa"]=>
-  string(3) "bbb"
-}
+bool(false)
+-- (2)
+bool(false)
 bool(false)
 bool(false)
+-- (3)
+bool(false)
+bool(false)
+bool(false)
+-- (4)
+bool(false)
 array(0) {
 }
 array(1) {
@@ -92,39 +89,20 @@ array(1) {
   ["var_name"]=>
   string(0) ""
 }
-array(4) {
-  ["var_name"]=>
-  string(0) ""
-  ["asdas"]=>
-  NULL
-  ["qwe"]=>
-  NULL
-  [""]=>
-  NULL
-}
-array(4) {
-  ["var_name"]=>
-  NULL
-  ["asdas"]=>
-  string(4) "text"
-  ["qwe"]=>
-  NULL
-  [""]=>
-  NULL
-}
-array(1) {
-  [""]=>
-  string(0) ""
-}
+-- (5)
+
+Warning: filter_var_array(): Empty keys are not allowed in the definition array in %s on line %d
+bool(false)
+
+Warning: filter_var_array(): Empty keys are not allowed in the definition array in %s on line %d
+bool(false)
+bool(false)
 array(1) {
   [""]=>
   string(0) ""
 }
 int(-1)
-array(1) {
-  [""]=>
-  string(0) ""
-}
+bool(false)
 array(1) {
   [""]=>
   string(0) ""