From f19b49815c4fc10be476826877303375ecf990ee Mon Sep 17 00:00:00 2001 From: Pierre Joye Date: Wed, 26 Aug 2009 19:57:01 +0000 Subject: [PATCH] - fix #44683, popen crashes when an invalid mode is passed (works on 2k8/vista/win7) --- TSRM/tsrm_win32.c | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/TSRM/tsrm_win32.c b/TSRM/tsrm_win32.c index c3d29cdd6d..f523ead703 100644 --- a/TSRM/tsrm_win32.c +++ b/TSRM/tsrm_win32.c @@ -179,20 +179,39 @@ TSRM_API FILE *popen(const char *command, const char *type) TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd, char *env) { FILE *stream = NULL; - int fno, str_len = strlen(type), read, mode; + int fno, type_len = strlen(type), read, mode; STARTUPINFO startup; PROCESS_INFORMATION process; SECURITY_ATTRIBUTES security; HANDLE in, out; - char *cmd; process_pair *proc; + char *cmd; + int i; + char *ptype = (char *)type; TSRMLS_FETCH(); + if (!type) { + return NULL; + } + + /*The following two checks can be removed once we drop XP support */ + type_len = strlen(type); + if (type_len <1 || type_len > 2) { + return NULL; + } + + for (i=0; i < type_len; i++) { + if (!(*ptype == 'r' || *ptype == 'w' || *ptype == 'b' || *ptype == 't')) { + return NULL; + } + ptype++; + } + security.nLength = sizeof(SECURITY_ATTRIBUTES); security.bInheritHandle = TRUE; security.lpSecurityDescriptor = NULL; - if (!str_len || !CreatePipe(&in, &out, &security, 2048L)) { + if (!type_len || !CreatePipe(&in, &out, &security, 2048L)) { return NULL; } @@ -204,7 +223,7 @@ TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd, startup.hStdError = GetStdHandle(STD_ERROR_HANDLE); read = (type[0] == 'r') ? TRUE : FALSE; - mode = ((str_len == 2) && (type[1] == 'b')) ? O_BINARY : O_TEXT; + mode = ((type_len == 2) && (type[1] == 'b')) ? O_BINARY : O_TEXT; if (read) { -- 2.50.1