From: Pierre Joye <pajoye@php.net>
Date: Wed, 26 Aug 2009 19:57:01 +0000 (+0000)
Subject: - fix #44683, popen crashes when an invalid mode is passed (works on 2k8/vista/win7)
X-Git-Tag: php-5.4.0alpha1~191^2~2747
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cf889a37ac20eea873d4ec30afdd90eaa4483389;p=php

- fix #44683, popen crashes when an invalid mode is passed (works on 2k8/vista/win7)
---

diff --git a/TSRM/tsrm_win32.c b/TSRM/tsrm_win32.c
index e7a07ba8d8..b43ccdf26b 100644
--- a/TSRM/tsrm_win32.c
+++ b/TSRM/tsrm_win32.c
@@ -306,7 +306,7 @@ TSRM_API FILE *popen(const char *command, const char *type)
 TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd, char *env)
 {
 	FILE *stream = NULL;
-	int fno, str_len = strlen(type), read, mode;
+	int fno, type_len = strlen(type), read, mode;
 	STARTUPINFO startup;
 	PROCESS_INFORMATION process;
 	SECURITY_ATTRIBUTES security;
@@ -314,13 +314,32 @@ TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd,
 	DWORD dwCreateFlags = 0;
 	process_pair *proc;
 	char *cmd;
+	int i;
+	char *ptype = (char *)type;
 	TSRMLS_FETCH();
 
+	if (!type) {
+		return NULL;
+	}
+
+	/*The following two checks can be removed once we drop XP support */
+	type_len = strlen(type);
+	if (type_len <1 || type_len > 2) {
+		return NULL;
+	}
+
+	for (i=0; i < type_len; i++) {
+		if (!(*ptype == 'r' || *ptype == 'w' || *ptype == 'b' || *ptype == 't')) {
+			return NULL;
+		}
+		ptype++;
+	}
+
 	security.nLength				= sizeof(SECURITY_ATTRIBUTES);
 	security.bInheritHandle			= TRUE;
 	security.lpSecurityDescriptor	= NULL;
 
-	if (!str_len || !CreatePipe(&in, &out, &security, 2048L)) {
+	if (!type_len || !CreatePipe(&in, &out, &security, 2048L)) {
 		return NULL;
 	}
 
@@ -332,7 +351,7 @@ TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd,
 	startup.hStdError	= GetStdHandle(STD_ERROR_HANDLE);
 
 	read = (type[0] == 'r') ? TRUE : FALSE;
-	mode = ((str_len == 2) && (type[1] == 'b')) ? O_BINARY : O_TEXT;
+	mode = ((type_len == 2) && (type[1] == 'b')) ? O_BINARY : O_TEXT;
 
 
 	if (read) {