archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 14:08:47 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix integer overflow in {stream,file}_{get,put}_contents()

Browse source
This commit is contained in:
Michael Wallner 2014-07-02 09:53:03 +02:00
parent 899fe3d8af
commit 34e686c556
2 changed files with 17 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

16
ext/standard/file.c
View file

@ -518,7 +518,7 @@ PHP_FUNCTION(file_get_contents)
char *contents; char *contents;
zend_bool use_include_path = 0; zend_bool use_include_path = 0;
php_stream *stream; php_stream *stream;
int len; long len;
long offset = -1; long offset = -1;
long maxlen = PHP_STREAM_COPY_ALL; long maxlen = PHP_STREAM_COPY_ALL;
zval *zcontext = NULL; zval *zcontext = NULL;
@ -550,6 +550,10 @@ PHP_FUNCTION(file_get_contents)
} }
if ((len = php_stream_copy_to_mem(stream, &contents, maxlen, 0)) > 0) { if ((len = php_stream_copy_to_mem(stream, &contents, maxlen, 0)) > 0) {
if (len > INT_MAX) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "content truncated from %ld to %d bytes", len, INT_MAX);
len = INT_MAX;
}
RETVAL_STRINGL(contents, len, 0); RETVAL_STRINGL(contents, len, 0);
} else if (len == 0) { } else if (len == 0) {
RETVAL_EMPTY_STRING(); RETVAL_EMPTY_STRING();
@ -569,7 +573,7 @@ PHP_FUNCTION(file_put_contents)
char *filename; char *filename;
int filename_len; int filename_len;
zval *data; zval *data;
int numbytes = 0; long numbytes = 0;
long flags = 0; long flags = 0;
zval *zcontext = NULL; zval *zcontext = NULL;
php_stream_context *context = NULL; php_stream_context *context = NULL;
@ -621,6 +625,10 @@ PHP_FUNCTION(file_put_contents)
if (php_stream_copy_to_stream_ex(srcstream, stream, PHP_STREAM_COPY_ALL, &len) != SUCCESS) { if (php_stream_copy_to_stream_ex(srcstream, stream, PHP_STREAM_COPY_ALL, &len) != SUCCESS) {
numbytes = -1; numbytes = -1;
} else { } else {
if (len > LONG_MAX) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "content truncated from %lu to %ld bytes", (unsigned long) len, LONG_MAX);
len = LONG_MAX;
}
numbytes = len; numbytes = len;
} }
break; break;
@ -636,7 +644,7 @@ PHP_FUNCTION(file_put_contents)
if (Z_STRLEN_P(data)) { if (Z_STRLEN_P(data)) {
numbytes = php_stream_write(stream, Z_STRVAL_P(data), Z_STRLEN_P(data)); numbytes = php_stream_write(stream, Z_STRVAL_P(data), Z_STRLEN_P(data));
if (numbytes != Z_STRLEN_P(data)) { if (numbytes != Z_STRLEN_P(data)) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only %d of %d bytes written, possibly out of free disk space", numbytes, Z_STRLEN_P(data)); php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only %ld of %d bytes written, possibly out of free disk space", numbytes, Z_STRLEN_P(data));
numbytes = -1; numbytes = -1;
} }
} }
@ -679,7 +687,7 @@ PHP_FUNCTION(file_put_contents)
if (zend_std_cast_object_tostring(data, &out, IS_STRING TSRMLS_CC) == SUCCESS) { if (zend_std_cast_object_tostring(data, &out, IS_STRING TSRMLS_CC) == SUCCESS) {
numbytes = php_stream_write(stream, Z_STRVAL(out), Z_STRLEN(out)); numbytes = php_stream_write(stream, Z_STRVAL(out), Z_STRLEN(out));
if (numbytes != Z_STRLEN(out)) { if (numbytes != Z_STRLEN(out)) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only %d of %d bytes written, possibly out of free disk space", numbytes, Z_STRLEN(out)); php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only %ld of %d bytes written, possibly out of free disk space", numbytes, Z_STRLEN(out));
numbytes = -1; numbytes = -1;
} }
zval_dtor(&out); zval_dtor(&out);

6
ext/standard/streamsfuncs.c
View file

@ -407,7 +407,7 @@ PHP_FUNCTION(stream_get_contents)
zval *zsrc; zval *zsrc;
long maxlen = PHP_STREAM_COPY_ALL, long maxlen = PHP_STREAM_COPY_ALL,
desiredpos = -1L; desiredpos = -1L;
int len; long len;
char *contents = NULL; char *contents = NULL;
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|ll", &zsrc, &maxlen, &desiredpos) == FAILURE) { if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|ll", &zsrc, &maxlen, &desiredpos) == FAILURE) {
@ -439,6 +439,10 @@ PHP_FUNCTION(stream_get_contents)
len = php_stream_copy_to_mem(stream, &contents, maxlen, 0); len = php_stream_copy_to_mem(stream, &contents, maxlen, 0);
if (contents) { if (contents) {
if (len > INT_MAX) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "content truncated from %ld to %d bytes", len, INT_MAX);
len = INT_MAX;
}
RETVAL_STRINGL(contents, len, 0); RETVAL_STRINGL(contents, len, 0);
} else { } else {
RETVAL_EMPTY_STRING(); RETVAL_EMPTY_STRING();