archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-17037: UAF in user filter when adding existing filter name due to incorrect error handling

Browse source 
There are two functions that can each fail in their own way. If the last
function fails we have to remove the filter entry from the hash table,
otherwise we risk a UAF. Note also that removing the entry from the
table on failure will also free its memory.

Closes GH-17038.
This commit is contained in:
Niels Dossche 2024-12-03 22:47:53 +01:00
parent 9c40bdaaf5
commit 00f4881e90
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 19 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NEWS
View file

@ -2,6 +2,9 @@ PHP NEWS
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.3.16 ?? ??? ????, PHP 8.3.16
- Streams:
. Fixed bug GH-17037 (UAF in user filter when adding existing filter name due
to incorrect error handling). (nielsdos)
19 Dec 2024, PHP 8.3.15 19 Dec 2024, PHP 8.3.15

8
ext/standard/tests/filters/gh17037.phpt Normal file
View file

@ -0,0 +1,8 @@
--TEST--
GH-17037 (UAF in user filter when adding existing filter name due to incorrect error handling)
--FILE--
<?php
var_dump(stream_filter_register('string.toupper', 'filter_string_toupper'));
?>
--EXPECT--
bool(false)

12
ext/standard/user_filters.c
View file

@ -516,13 +516,17 @@ PHP_FUNCTION(stream_filter_register)
fdat = ecalloc(1, sizeof(struct php_user_filter_data)); fdat = ecalloc(1, sizeof(struct php_user_filter_data));
fdat->classname = zend_string_copy(classname); fdat->classname = zend_string_copy(classname);
if (zend_hash_add_ptr(BG(user_filter_map), filtername, fdat) != NULL && if (zend_hash_add_ptr(BG(user_filter_map), filtername, fdat) != NULL) {
php_stream_filter_register_factory_volatile(filtername, &user_filter_factory) == SUCCESS) { if (php_stream_filter_register_factory_volatile(filtername, &user_filter_factory) == SUCCESS) {
RETVAL_TRUE; RETURN_TRUE;
}
zend_hash_del(BG(user_filter_map), filtername);
} else { } else {
zend_string_release_ex(classname, 0); zend_string_release_ex(classname, 0);
efree(fdat); efree(fdat);
RETVAL_FALSE;
} }
RETURN_FALSE;
} }
/* }}} */ /* }}} */