From: Stanislav Malyshev <stas@php.net>
Date: Mon, 7 May 2012 19:08:36 +0000 (-0700)
Subject: improve fix for CVE-2012-1823
X-Git-Tag: php-5.5.0alpha1~228^2^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7de4b75f74a817c3fead32710e04cd015bcc5360;p=php

improve fix for CVE-2012-1823
---

diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index 760ad668e1..a7ac26f0d0 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -1561,10 +1561,15 @@ int main(int argc, char *argv[])
 		}
 	}
 
-	if(query_string = getenv("QUERY_STRING")) {
+	if((query_string = getenv("QUERY_STRING")) != NULL && strchr(query_string, '=') == NULL) {
+		/* we've got query string that has no = - apache CGI will pass it to command line */
+		unsigned char *p;
 		decoded_query_string = strdup(query_string);
 		php_url_decode(decoded_query_string, strlen(decoded_query_string));
-		if(*decoded_query_string == '-' && strchr(decoded_query_string, '=') == NULL) {
+		for (p = decoded_query_string; *p &&  *p <= ' '; p++) {
+			/* skip all leading spaces */
+		}
+		if(*p == '-') {
 			skip_getopt = 1;
 		}
 		free(decoded_query_string);
@@ -1819,7 +1824,7 @@ consult the installation file that came with this distribution, or visit \n\
 	}
 
 	zend_first_try {
-		while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 1, 2)) != -1) {
+		while (!skip_getopt && (c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 1, 2)) != -1) {
 			switch (c) {
 				case 'T':
 					benchmark = 1;