- fix #44683, popen crashes when an invalid mode is passed (works on 2k8/vista/win7)

diff --git a/TSRM/tsrm_win32.c b/TSRM/tsrm_win32.c
index c3d29cdd6d89fe84fff7c1fd278fda47018fa256..f523ead70348ea90130954a371c756705eea9b4e 100644 (file)
--- a/TSRM/tsrm_win32.c
+++ b/TSRM/tsrm_win32.c
@@ -179,20 +179,39 @@ TSRM_API FILE *popen(const char *command, const char *type)
 TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd, char *env)
 {
        FILE *stream = NULL;
-       int fno, str_len = strlen(type), read, mode;
+       int fno, type_len = strlen(type), read, mode;
        STARTUPINFO startup;
        PROCESS_INFORMATION process;
        SECURITY_ATTRIBUTES security;
        HANDLE in, out;
-       char *cmd;
        process_pair *proc;
+       char *cmd;
+       int i;
+       char *ptype = (char *)type;
        TSRMLS_FETCH();
 
+       if (!type) {
+               return NULL;
+       }
+
+       /*The following two checks can be removed once we drop XP support */
+       type_len = strlen(type);
+       if (type_len <1 || type_len > 2) {
+               return NULL;
+       }
+
+       for (i=0; i < type_len; i++) {
+               if (!(*ptype == 'r' || *ptype == 'w' || *ptype == 'b' || *ptype == 't')) {
+                       return NULL;
+               }
+               ptype++;
+       }
+
        security.nLength                                = sizeof(SECURITY_ATTRIBUTES);
        security.bInheritHandle                 = TRUE;
        security.lpSecurityDescriptor   = NULL;
 
-       if (!str_len || !CreatePipe(&in, &out, &security, 2048L)) {
+       if (!type_len || !CreatePipe(&in, &out, &security, 2048L)) {
                return NULL;
        }
 
@@ -204,7 +223,7 @@ TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd,
        startup.hStdError       = GetStdHandle(STD_ERROR_HANDLE);
 
        read = (type[0] == 'r') ? TRUE : FALSE;
-       mode = ((str_len == 2) && (type[1] == 'b')) ? O_BINARY : O_TEXT;
+       mode = ((type_len == 2) && (type[1] == 'b')) ? O_BINARY : O_TEXT;
 
 
        if (read) {