Fix missing type checks in various functions

diff --git a/NEWS b/NEWS
index 47ab0bd68393f44b574acedc65fc254f419daff2..97c9ae285245d173bbfb4d085eb272576287894a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,17 +2,26 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2014, PHP 5.4.32
 
+- COM:
+  . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
+
 - Readline:
   . Fixed bug #55496 (Interactive mode doesn't force a newline before the
     prompt). (Bob, Johannes)
   . Fixed bug #67496 (Save command history when exiting interactive shell
     with control-c). (Dmitry Saprykin, Johannes)
 
+- Sessions:
+  . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).
+
 - SPL:
   . Fixed bug #67539 (ArrayIterator use-after-free due to object change during
     sorting). (research at insighti dot org, Laruence)
   . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence)
 
+- OpenSSL:
+  . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas).
+
 24 Jul 2014, PHP 5.4.31
 
 - Core:

diff --git a/ext/com_dotnet/com_com.c b/ext/com_dotnet/com_com.c
index f77779d69162da07a7fbb879f68d10ec04ff2f37..500cabd41c87a407b620972999abdf50b0a85172 100644 (file)
--- a/ext/com_dotnet/com_com.c
+++ b/ext/com_dotnet/com_com.c
@@ -698,9 +698,9 @@ PHP_FUNCTION(com_event_sink)
                /* 0 => typelibname, 1 => dispname */
                zval **tmp;
 
-               if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS)
+               if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING)
                        typelibname = Z_STRVAL_PP(tmp);
-               if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS)
+               if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING)
                        dispname = Z_STRVAL_PP(tmp);
        } else if (sink != NULL) {
                convert_to_string(sink);

diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index 0ec2a9a6bd61254b0b7270ce56cd793e1d68c8ad..05d946a548c3685c2c4d36becfffffa3ee7197b1 100755 (executable)
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -654,7 +654,7 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
                return (time_t)-1;
        }
 
-       if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) {
+       if (ASN1_STRING_length(timestr) != strlen((char *)ASN1_STRING_data(timestr))) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp");
                return (time_t)-1;
        }
@@ -782,13 +782,13 @@ static int add_oid_section(struct php_x509_request * req TSRMLS_DC) /* {{{ */
                        req->config_filename, req->var, req->req_config TSRMLS_CC) == FAILURE) return FAILURE
 
 #define SET_OPTIONAL_STRING_ARG(key, varname, defval)  \
-       if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
+       if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING) \
                varname = Z_STRVAL_PP(item); \
        else \
                varname = defval
 
 #define SET_OPTIONAL_LONG_ARG(key, varname, defval)    \
-       if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
+       if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_LONG) \
                varname = Z_LVAL_PP(item); \
        else \
                varname = defval
@@ -847,7 +847,8 @@ static int php_openssl_parse_config(struct php_x509_request * req, zval * option
                }
        }
 
-       if (req->priv_key_encrypt && optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key_cipher", sizeof("encrypt_key_cipher"), (void**)&item) == SUCCESS) {
+       if (req->priv_key_encrypt && optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key_cipher", sizeof("encrypt_key_cipher"), (void**)&item) == SUCCESS 
+               && Z_TYPE_PP(item) == IS_LONG) {
                long cipher_algo = Z_LVAL_PP(item);
                const EVP_CIPHER* cipher = php_openssl_get_evp_cipher_from_algo(cipher_algo);
                if (cipher == NULL) {
@@ -1962,7 +1963,7 @@ PHP_FUNCTION(openssl_pkcs12_export_to_file)
        }
 
        /* parse extra config from args array, promote this to an extra function */
-       if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
+       if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING)
                friendly_name = Z_STRVAL_PP(item);
        /* certpbe (default RC2-40)
           keypbe (default 3DES)
@@ -2040,7 +2041,7 @@ PHP_FUNCTION(openssl_pkcs12_export)
        }
 
        /* parse extra config from args array, promote this to an extra function */
-       if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
+       if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING)
                friendly_name = Z_STRVAL_PP(item);
 
        if (args && zend_hash_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts"), (void**)&item) == SUCCESS)

diff --git a/ext/openssl/tests/026.phpt b/ext/openssl/tests/026.phpt
new file mode 100644 (file)
index 0000000..38d626d
--- /dev/null
+++ b/ext/openssl/tests/026.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Options type checks
+--SKIPIF--
+<?php if (!extension_loaded("openssl")) print "skip"; ?>
+--FILE--
+<?php
+$x = openssl_pkey_new();
+$csr = openssl_csr_new(["countryName" => "DE"], $x, ["x509_extensions" => 0xDEADBEEF]);
+?>
+DONE
+--EXPECT--
+DONE

diff --git a/ext/session/session.c b/ext/session/session.c
index 7d145c362b4f487694038badcd7bf1df52353cf1..306aba3a7de037e3a5d092f81e8a5d7a39294348 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -296,7 +296,8 @@ PHPAPI char *php_session_create_id(PS_CREATE_SID_ARGS) /* {{{ */
 
        if (zend_hash_find(&EG(symbol_table), "_SERVER", sizeof("_SERVER"), (void **) &array) == SUCCESS &&
                Z_TYPE_PP(array) == IS_ARRAY &&
-               zend_hash_find(Z_ARRVAL_PP(array), "REMOTE_ADDR", sizeof("REMOTE_ADDR"), (void **) &token) == SUCCESS
+               zend_hash_find(Z_ARRVAL_PP(array), "REMOTE_ADDR", sizeof("REMOTE_ADDR"), (void **) &token) == SUCCESS &&
+               Z_TYPE_PP(token) == IS_STRING
        ) {
                remote_addr = Z_STRVAL_PP(token);
        }