MFH:

Fixed possible crash and/or memory corruption in import_request_variables()
Fixed potential GLOBALS overwrite via import_request_variables().

diff --git a/NEWS b/NEWS
index 50096400183beded3517cee793d0867209501156..69b39a48c3125bf75fc29a2d7e461b3f24269c3c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,9 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, Version 4.4.1
+- Fixed possible crash and/or memory corruption in import_request_variables().
+  (Ilia)
+- Fixed potential GLOBALS overwrite via import_request_variables(). (Ilia)
 - Fixed possible GLOBALS variable override when register_globals are ON.
   (Ilia, Stefan)
 - Fixed possible register_globals toggle via parse_str(). (Ilia, Stefan)

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index de4d38b954ff9e2d67e040adfcb7cc85b13effc7..e64a0921f8cc446181ecbe708ba8fc432a12b9ea 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -3027,11 +3027,25 @@ static int copy_request_variable(void *pDest, int num_args, va_list args, zend_h
        prefix = va_arg(args, char *);
        prefix_len = va_arg(args, uint);
 
-       new_key_len = prefix_len + hash_key->nKeyLength;
-       new_key = (char *) emalloc(new_key_len);
+       if (!prefix_len) {
+               if (!hash_key->nKeyLength) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard.");
+                       return 0;
+               } else if (!strcmp(hash_key->arKey, "GLOBALS")) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite.");
+                       return 0; 
+               }
+       }
+
+       if (hash_key->nKeyLength) {
+               new_key_len = prefix_len + hash_key->nKeyLength;
+               new_key = (char *) emalloc(new_key_len);
 
-       memcpy(new_key, prefix, prefix_len);
-       memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
+               memcpy(new_key, prefix, prefix_len);
+               memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
+       } else {
+               new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h);
+       }
 
        zend_hash_del(&EG(symbol_table), new_key, new_key_len);
        ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0);