From ad2e304693ba206bee43a23f778cf7bc618b5385 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Thu, 29 Sep 2005 16:31:48 +0000 Subject: [PATCH] MFH: Fixed possible crash and/or memory corruption in import_request_variables() Fixed potential GLOBALS overwrite via import_request_variables(). --- NEWS | 3 +++ ext/standard/basic_functions.c | 22 ++++++++++++++++++---- 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/NEWS b/NEWS index 5009640018..69b39a48c3 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,9 @@ PHP 4 NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2005, Version 4.4.1 +- Fixed possible crash and/or memory corruption in import_request_variables(). + (Ilia) +- Fixed potential GLOBALS overwrite via import_request_variables(). (Ilia) - Fixed possible GLOBALS variable override when register_globals are ON. (Ilia, Stefan) - Fixed possible register_globals toggle via parse_str(). (Ilia, Stefan) diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c index de4d38b954..e64a0921f8 100644 --- a/ext/standard/basic_functions.c +++ b/ext/standard/basic_functions.c @@ -3027,11 +3027,25 @@ static int copy_request_variable(void *pDest, int num_args, va_list args, zend_h prefix = va_arg(args, char *); prefix_len = va_arg(args, uint); - new_key_len = prefix_len + hash_key->nKeyLength; - new_key = (char *) emalloc(new_key_len); + if (!prefix_len) { + if (!hash_key->nKeyLength) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard."); + return 0; + } else if (!strcmp(hash_key->arKey, "GLOBALS")) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite."); + return 0; + } + } + + if (hash_key->nKeyLength) { + new_key_len = prefix_len + hash_key->nKeyLength; + new_key = (char *) emalloc(new_key_len); - memcpy(new_key, prefix, prefix_len); - memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength); + memcpy(new_key, prefix, prefix_len); + memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength); + } else { + new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h); + } zend_hash_del(&EG(symbol_table), new_key, new_key_len); ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0); -- 2.50.1