Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)

diff --git a/NEWS b/NEWS
index 48f862774dcdef557ac840baa70381b8108f0c56..28b57bb267102362b48dfa6e381f47baab730bda 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,7 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.1.33
 
-
+- FPM:
+  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
+    (CVE-2019-11043) (Jakub Zelenka)
 
 29 Aug 2019, PHP 7.1.32
 

diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c
index 24a7e5d56ac653782c888af4d0dcfde448609c3c..50f92981f1fb5fa2a46e8452171c51b5c23568c7 100644 (file)
--- a/sapi/fpm/fpm/fpm_main.c
+++ b/sapi/fpm/fpm/fpm_main.c
@@ -1209,8 +1209,8 @@ static void init_request_info(void)
                                                                path_info = script_path_translated + ptlen;
                                                                tflag = (slen != 0 && (!orig_path_info || strcmp(orig_path_info, path_info) != 0));
                                                        } else {
-                                                               path_info = env_path_info ? env_path_info + pilen - slen : NULL;
-                                                               tflag = (orig_path_info != path_info);
+                                                               path_info = (env_path_info && pilen > slen) ? env_path_info + pilen - slen : NULL;
+                                                               tflag = path_info && (orig_path_info != path_info);
                                                        }
 
                                                        if (tflag) {

diff --git a/sapi/fpm/tests/bug78599-path-info-underflow.phpt b/sapi/fpm/tests/bug78599-path-info-underflow.phpt
new file mode 100644 (file)
index 0000000..edd4e0d
--- /dev/null
+++ b/sapi/fpm/tests/bug78599-path-info-underflow.phpt
@@ -0,0 +1,61 @@
+--TEST--
+FPM: bug78599 - env_path_info underflow - CVE-2019-11043
+--SKIPIF--
+<?php include "skipif.inc"; ?>
+--FILE--
+<?php
+
+require_once "tester.inc";
+
+$cfg = <<<EOT
+[global]
+error_log = {{FILE:LOG}}
+[unconfined]
+listen = {{ADDR}}
+pm = dynamic
+pm.max_children = 5
+pm.start_servers = 1
+pm.min_spare_servers = 1
+pm.max_spare_servers = 3
+EOT;
+
+$code = <<<EOT
+<?php
+echo "Test Start\n";
+var_dump(\$_SERVER["PATH_INFO"]);
+echo "Test End\n";
+EOT;
+
+$tester = new FPM\Tester($cfg, $code);
+$tester->start();
+$tester->expectLogStartNotices();
+$uri = $tester->makeSourceFile();
+$tester
+    ->request(
+        '',
+        [
+            'SCRIPT_FILENAME' => $uri . "/" . str_repeat('A', 35),
+            'PATH_INFO'       => '',
+            'HTTP_HUI'        => str_repeat('PTEST', 1000),
+        ],
+        $uri
+    )
+    ->expectBody(
+        [
+            'Test Start',
+            'string(0) ""',
+            'Test End'
+        ]
+    );
+$tester->terminate();
+$tester->close();
+
+?>
+Done
+--EXPECT--
+Done
+--CLEAN--
+<?php
+require_once "tester.inc";
+FPM\Tester::clean();
+?>

diff --git a/sapi/fpm/tests/tester.inc b/sapi/fpm/tests/tester.inc
index 70c03ad70f1c52b545271d30dd115d346a23416f..3b6702866cc142c258e8bcffc572f5517e686d6e 100644 (file)
--- a/sapi/fpm/tests/tester.inc
+++ b/sapi/fpm/tests/tester.inc
@@ -513,7 +513,7 @@ class Tester
             return new Response(null, true);
         }
         if (is_null($uri)) {
-            $uri = $this->makeFile('src.php', $this->code);
+            $uri = $this->makeSourceFile();
         }
 
         $params = array_merge(
@@ -538,7 +538,6 @@ class Tester
             ],
             $headers
         );
-
         try {
             $this->response = new Response(
                 $this->getClient($address, $connKeepAlive)->request_data($params, false)
@@ -944,6 +943,14 @@ class Tester
         return $filePath;
     }
 
+    /**
+     * @return string
+     */
+    public function makeSourceFile()
+    {
+        return $this->makeFile('src.php', $this->code);
+    }
+
     /**
      * @param string|null $msg
      */