From 71929ac5ee87972d63951ad2c20eedba2a68df55 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Wed, 19 Sep 2007 00:37:43 +0000 Subject: [PATCH] limit iconv parameter sizes - workaround for libc bug --- ext/iconv/iconv.c | 85 +++++++++++++++++++++++++++++++++++++------ ext/iconv/php_iconv.h | 4 ++ 2 files changed, 78 insertions(+), 11 deletions(-) diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c index 582a6778eb..57af813dce 100644 --- a/ext/iconv/iconv.c +++ b/ext/iconv/iconv.c @@ -230,12 +230,21 @@ static char _generic_superset_name[] = "UCS-4LE"; #define GENERIC_SUPERSET_NBYTES 4 /* }}} */ +static PHP_INI_MH(OnUpdateStringIconvCharset) +{ + if(new_value_length >= ICONV_CSNMAXLEN) { + return FAILURE; + } + OnUpdateString(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC); + return SUCCESS; +} + /* {{{ PHP_INI */ PHP_INI_BEGIN() - STD_PHP_INI_ENTRY("iconv.input_encoding", ICONV_INPUT_ENCODING, PHP_INI_ALL, OnUpdateString, input_encoding, zend_iconv_globals, iconv_globals) - STD_PHP_INI_ENTRY("iconv.output_encoding", ICONV_OUTPUT_ENCODING, PHP_INI_ALL, OnUpdateString, output_encoding, zend_iconv_globals, iconv_globals) - STD_PHP_INI_ENTRY("iconv.internal_encoding", ICONV_INTERNAL_ENCODING, PHP_INI_ALL, OnUpdateString, internal_encoding, zend_iconv_globals, iconv_globals) + STD_PHP_INI_ENTRY("iconv.input_encoding", ICONV_INPUT_ENCODING, PHP_INI_ALL, OnUpdateStringIconvCharset, input_encoding, zend_iconv_globals, iconv_globals) + STD_PHP_INI_ENTRY("iconv.output_encoding", ICONV_OUTPUT_ENCODING, PHP_INI_ALL, OnUpdateStringIconvCharset, output_encoding, zend_iconv_globals, iconv_globals) + STD_PHP_INI_ENTRY("iconv.internal_encoding", ICONV_INTERNAL_ENCODING, PHP_INI_ALL, OnUpdateStringIconvCharset, internal_encoding, zend_iconv_globals, iconv_globals) PHP_INI_END() /* }}} */ @@ -1921,7 +1930,7 @@ static void _php_iconv_show_error(php_iconv_err_t err, const char *out_charset, PHP_FUNCTION(iconv_strlen) { char *charset; - int charset_len; + int charset_len = 0; char *str; int str_len; @@ -1936,6 +1945,11 @@ PHP_FUNCTION(iconv_strlen) RETURN_FALSE; } + if (charset_len >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + err = _php_iconv_strlen(&retval, str, str_len, charset); _php_iconv_show_error(err, GENERIC_SUPERSET_NAME, charset TSRMLS_CC); if (err == PHP_ICONV_ERR_SUCCESS) { @@ -1951,7 +1965,7 @@ PHP_FUNCTION(iconv_strlen) PHP_FUNCTION(iconv_substr) { char *charset; - int charset_len; + int charset_len = 0; char *str; int str_len; long offset, length; @@ -1968,6 +1982,11 @@ PHP_FUNCTION(iconv_substr) RETURN_FALSE; } + if (charset_len >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + if (ZEND_NUM_ARGS() < 3) { length = str_len; } @@ -1993,7 +2012,7 @@ PHP_FUNCTION(iconv_substr) PHP_FUNCTION(iconv_strpos) { char *charset; - int charset_len; + int charset_len = 0; char *haystk; int haystk_len; char *ndl; @@ -2013,6 +2032,11 @@ PHP_FUNCTION(iconv_strpos) RETURN_FALSE; } + if (charset_len >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + if (offset < 0) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset not contained in string"); RETURN_FALSE; @@ -2039,7 +2063,7 @@ PHP_FUNCTION(iconv_strpos) PHP_FUNCTION(iconv_strrpos) { char *charset; - int charset_len; + int charset_len = 0; char *haystk; int haystk_len; char *ndl; @@ -2061,6 +2085,11 @@ PHP_FUNCTION(iconv_strrpos) RETURN_FALSE; } + if (charset_len >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + err = _php_iconv_strpos(&retval, haystk, haystk_len, ndl, ndl_len, -1, charset); _php_iconv_show_error(err, GENERIC_SUPERSET_NAME, charset TSRMLS_CC); @@ -2117,6 +2146,11 @@ PHP_FUNCTION(iconv_mime_encode) } if (zend_hash_find(Z_ARRVAL_P(pref), "input-charset", sizeof("input-charset"), (void **)&ppval) == SUCCESS) { + if (Z_STRLEN_PP(ppval) >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + if (Z_TYPE_PP(ppval) == IS_STRING && Z_STRLEN_PP(ppval) > 0) { in_charset = Z_STRVAL_PP(ppval); } @@ -2124,6 +2158,11 @@ PHP_FUNCTION(iconv_mime_encode) if (zend_hash_find(Z_ARRVAL_P(pref), "output-charset", sizeof("output-charset"), (void **)&ppval) == SUCCESS) { + if (Z_STRLEN_PP(ppval) >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + if (Z_TYPE_PP(ppval) == IS_STRING && Z_STRLEN_PP(ppval) > 0) { out_charset = Z_STRVAL_PP(ppval); } @@ -2188,7 +2227,7 @@ PHP_FUNCTION(iconv_mime_encode) PHP_FUNCTION(iconv_mime_decode) { char *encoded_str; - int encoded_str_len; + int encoded_str_len = 0; char *charset; int charset_len; long mode = 0; @@ -2205,6 +2244,11 @@ PHP_FUNCTION(iconv_mime_decode) RETURN_FALSE; } + if (charset_len >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + err = _php_iconv_mime_decode(&retval, encoded_str, encoded_str_len, charset, NULL, mode); _php_iconv_show_error(err, charset, "???" TSRMLS_CC); @@ -2228,7 +2272,7 @@ PHP_FUNCTION(iconv_mime_decode_headers) const char *encoded_str; int encoded_str_len; char *charset; - int charset_len; + int charset_len = 0; long mode = 0; php_iconv_err_t err = PHP_ICONV_ERR_SUCCESS; @@ -2241,6 +2285,11 @@ PHP_FUNCTION(iconv_mime_decode_headers) RETURN_FALSE; } + if (charset_len >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + array_init(return_value); while (encoded_str_len > 0) { @@ -2323,13 +2372,18 @@ PHP_NAMED_FUNCTION(php_if_iconv) { char *in_charset, *out_charset, *in_buffer, *out_buffer; size_t out_len; - int in_charset_len, out_charset_len, in_buffer_len; + int in_charset_len = 0, out_charset_len = 0, in_buffer_len; php_iconv_err_t err; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sss", &in_charset, &in_charset_len, &out_charset, &out_charset_len, &in_buffer, &in_buffer_len) == FAILURE) return; + if (in_charset_len >= ICONV_CSNMAXLEN || out_charset_len >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + err = php_iconv_string(in_buffer, (size_t)in_buffer_len, &out_buffer, &out_len, out_charset, in_charset); _php_iconv_show_error(err, out_charset, in_charset TSRMLS_CC); @@ -2346,11 +2400,16 @@ PHP_NAMED_FUNCTION(php_if_iconv) PHP_FUNCTION(iconv_set_encoding) { char *type, *charset; - int type_len, charset_len, retval; + int type_len, charset_len =0, retval; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &type, &type_len, &charset, &charset_len) == FAILURE) return; + if (charset_len >= ICONV_CSNMAXLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Charset parameter exceeds the maximum allowed length of %d characters", ICONV_CSNMAXLEN); + RETURN_FALSE; + } + if(!strcasecmp("input_encoding", type)) { retval = zend_alter_ini_entry("iconv.input_encoding", sizeof("iconv.input_encoding"), charset, charset_len, PHP_INI_USER, PHP_INI_STAGE_RUNTIME); } else if(!strcasecmp("output_encoding", type)) { @@ -2744,6 +2803,10 @@ static php_stream_filter *php_iconv_stream_filter_factory_create(const char *nam ++to_charset; to_charset_len = strlen(to_charset); + if (from_charset_len >= ICONV_CSNMAXLEN || to_charset_len >= ICONV_CSNMAXLEN) { + return NULL; + } + if (NULL == (inst = pemalloc(sizeof(php_iconv_stream_filter), persistent))) { return NULL; } diff --git a/ext/iconv/php_iconv.h b/ext/iconv/php_iconv.h index e79f1d8d08..383f232d26 100644 --- a/ext/iconv/php_iconv.h +++ b/ext/iconv/php_iconv.h @@ -78,6 +78,10 @@ ZEND_END_MODULE_GLOBALS(iconv) #define ICONV_OUTPUT_ENCODING "ISO-8859-1" #define ICONV_INTERNAL_ENCODING "ISO-8859-1" +#ifndef ICONV_CSNMAXLEN +#define ICONV_CSNMAXLEN 64 +#endif + /* {{{ typedef enum php_iconv_err_t */ typedef enum _php_iconv_err_t { PHP_ICONV_ERR_SUCCESS = SUCCESS, -- 2.40.0