Fix #69719 - more checks for nulls in paths

diff --git a/ext/dom/document.c b/ext/dom/document.c
index 48a19dd05de4423f63bb08ef808894a2b859452e..097fcba4675204ae8086973a1a4bac50414e4439 100644 (file)
--- a/ext/dom/document.c
+++ b/ext/dom/document.c
@@ -1761,7 +1761,7 @@ PHP_FUNCTION(dom_document_save)
        char *file;
        long options = 0;
 
-       if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
+       if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
                return;
        }
 
@@ -1990,7 +1990,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
        int                     is_valid;
        char resolved_path[MAXPATHLEN + 1];
 
-       if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
+       if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
                return;
        }
 
@@ -2003,6 +2003,10 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
 
        switch (type) {
        case DOM_LOAD_FILE:
+               if (CHECK_NULL_PATH(source, source_len)) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
+                       RETURN_FALSE;
+               }
                valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
                if (!valid_file) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
@@ -2079,7 +2083,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
        int                     is_valid;
        char resolved_path[MAXPATHLEN + 1];
 
-       if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
+       if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
                return;
        }
 
@@ -2092,6 +2096,10 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
 
        switch (type) {
        case DOM_LOAD_FILE:
+               if (CHECK_NULL_PATH(source, source_len)) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
+                       RETURN_FALSE;
+               }
                valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
                if (!valid_file) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
@@ -2172,7 +2180,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 
        id = getThis();
 
-       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
+       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
                return;
        }
 
@@ -2182,6 +2190,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
        }
 
        if (mode == DOM_LOAD_FILE) {
+               if (CHECK_NULL_PATH(source, source_len)) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
+                       RETURN_FALSE;
+               }
                ctxt = htmlCreateFileParserCtxt(source, NULL);
        } else {
                source_len = xmlStrlen(source);
@@ -2270,7 +2282,7 @@ PHP_FUNCTION(dom_document_save_html_file)
        char *file;
        const char *encoding;
 
-       if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
+       if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
                return;
        }
 

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index d258c3dbc7862534762d3640688f1b980c031459..e52757567eacfa5cf5ee2fc3eee3639f722bce6d 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1790,7 +1790,7 @@ PHP_FUNCTION(imagefilledarc)
        long cx, cy, w, h, ST, E, col, style;
        gdImagePtr im;
        int e, st;
-       
+
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rllllllll", &IM, &cx, &cy, &w, &h, &ST, &E, &col, &style) == FAILURE) {
                return;
        }
@@ -2033,7 +2033,7 @@ PHP_FUNCTION(imagegrabwindow)
        if ( handle == 0 ) {
                goto clean;
        }
-       pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");  
+       pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");
 
        if ( pPrintWindow )  {
                pPrintWindow(window, memDC, (UINT) client_area);
@@ -3984,7 +3984,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
                        if (zend_hash_get_current_data_ex(HASH_OF(EXT), (void **) &item, &pos) == FAILURE) {
                                continue;
                        }
-               
+
                        if (strcmp("linespacing", key) == 0) {
                                convert_to_double_ex(item);
                                strex.flags |= gdFTEX_LINESPACE;
@@ -4006,7 +4006,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
 #endif
 
        PHP_GD_CHECK_OPEN_BASEDIR(fontname, "Invalid font filename");
-       
+
 #ifdef USE_GD_IMGSTRTTF
 # if HAVE_GD_STRINGFTEX
        if (extended) {
@@ -4071,7 +4071,7 @@ PHP_FUNCTION(imagepsloadfont)
        struct stat st;
 #endif
 
-       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
+       if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
                return;
        }
 
@@ -4411,11 +4411,11 @@ PHP_FUNCTION(imagepsbbox)
        if (argc != 3 && argc != 6) {
                ZEND_WRONG_PARAM_COUNT();
        }
-       
+
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "srl|lld", &str, &str_len, &fnt, &sz, &sp, &wd, &angle) == FAILURE) {
                return;
        }
-       
+
        if (argc == 6) {
                space = sp;
                add_width = wd;
@@ -4600,7 +4600,7 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 #ifdef HAVE_GD_JPG
     long ignore_warning;
 #endif
-       
+
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pplll", &f_org, &f_org_len, &f_dest, &f_dest_len, &height, &width, &threshold) == FAILURE) {
                return;
        }