archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-18 06:58:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fixed bug #45151 (Crash with URI/file..php (filename contains 2 dots))

Browse source
This commit is contained in:
Dmitry Stogov 2008-07-15 13:39:17 +00:00
parent c27eba9bcf
commit 05f3ed67d4
1 changed files with 36 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

45
sapi/cgi/cgi_main.c
View file

@ -866,6 +866,39 @@ static void php_cgi_usage(char *argv0)
} }
/* }}} */ /* }}} */
/* {{{ is_valid_path
*
* some server configurations allow '..' to slip through in the
* translated path. We'll just refuse to handle such a path.
*/
static int is_valid_path(const char *path)
{
const char *p;
if (!path) {
return 0;
}
p = strstr(path, "..");
if (p) {
if ((p == path || IS_SLASH(*(p-1))) &&
(*(p+2) == 0 || IS_SLASH(*(p+2)))) {
return 0;
}
while (1) {
p = strstr(p+1, "..");
if (!p) {
break;
}
if (IS_SLASH(*(p-1)) &&
(*(p+2) == 0 || IS_SLASH(*(p+2)))) {
return 0;
}
}
}
return 1;
}
/* }}} */
/* {{{ init_request_info /* {{{ init_request_info
initializes request_info structure initializes request_info structure
@ -1161,9 +1194,7 @@ static void init_request_info(TSRMLS_D)
if (pt) { if (pt) {
efree(pt); efree(pt);
} }
/* some server configurations allow '..' to slip through in the if (is_valid_path(script_path_translated)) {
translated path. We'll just refuse to handle such a path. */
if (script_path_translated && !strstr(script_path_translated, "..")) {
SG(request_info).path_translated = estrdup(script_path_translated); SG(request_info).path_translated = estrdup(script_path_translated);
} }
} else { } else {
@ -1194,9 +1225,7 @@ static void init_request_info(TSRMLS_D)
} else { } else {
SG(request_info).request_uri = env_script_name; SG(request_info).request_uri = env_script_name;
} }
/* some server configurations allow '..' to slip through in the if (is_valid_path(script_path_translated)) {
translated path. We'll just refuse to handle such a path. */
if (script_path_translated && !strstr(script_path_translated, "..")) {
SG(request_info).path_translated = estrdup(script_path_translated); SG(request_info).path_translated = estrdup(script_path_translated);
} }
free(real_path); free(real_path);
@ -1211,9 +1240,7 @@ static void init_request_info(TSRMLS_D)
if (!CGIG(discard_path) && env_path_translated) { if (!CGIG(discard_path) && env_path_translated) {
script_path_translated = env_path_translated; script_path_translated = env_path_translated;
} }
/* some server configurations allow '..' to slip through in the if (is_valid_path(script_path_translated)) {
translated path. We'll just refuse to handle such a path. */
if (script_path_translated && !strstr(script_path_translated, "..")) {
SG(request_info).path_translated = estrdup(script_path_translated); SG(request_info).path_translated = estrdup(script_path_translated);
} }
} }