archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed bug #19313

Browse source 
Fixed argument count check for system/exec/passthru functions
Added a check to system/exec/passthru functions to make sure execution
parameter is not blank before attempting to execute it.
This commit is contained in:
Ilia Alshanetsky 2002-09-19 18:59:32 +00:00
parent 9259c4e598
commit a694fa9ca7
2 changed files with 20 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

21
ext/standard/exec.c
View file

@ -309,9 +309,14 @@ PHP_FUNCTION(exec)
int arg_count = ZEND_NUM_ARGS(); int arg_count = ZEND_NUM_ARGS();
int ret; int ret;
if (arg_count > 3 || zend_get_parameters_ex(arg_count, &arg1, &arg2, &arg3) == FAILURE) { if (arg_count < 1 || arg_count > 3 || zend_get_parameters_ex(arg_count, &arg1, &arg2, &arg3) == FAILURE) {
WRONG_PARAM_COUNT; WRONG_PARAM_COUNT;
} }
if (!Z_STRLEN_PP(arg1)) {
PHP_EMPTY_EXEC_PARAM;
}
switch (arg_count) { switch (arg_count) {
case 1: case 1:
ret = php_Exec(0, Z_STRVAL_PP(arg1), NULL, return_value TSRMLS_CC); ret = php_Exec(0, Z_STRVAL_PP(arg1), NULL, return_value TSRMLS_CC);
@ -337,9 +342,14 @@ PHP_FUNCTION(system)
int arg_count = ZEND_NUM_ARGS(); int arg_count = ZEND_NUM_ARGS();
int ret; int ret;
if (arg_count > 2 || zend_get_parameters_ex(arg_count, &arg1, &arg2) == FAILURE) { if (arg_count < 1 || arg_count > 2 || zend_get_parameters_ex(arg_count, &arg1, &arg2) == FAILURE) {
WRONG_PARAM_COUNT; WRONG_PARAM_COUNT;
} }
if (!Z_STRLEN_PP(arg1)) {
PHP_EMPTY_EXEC_PARAM;
}
switch (arg_count) { switch (arg_count) {
case 1: case 1:
ret = php_Exec(1, Z_STRVAL_PP(arg1), NULL, return_value TSRMLS_CC); ret = php_Exec(1, Z_STRVAL_PP(arg1), NULL, return_value TSRMLS_CC);
@ -361,9 +371,14 @@ PHP_FUNCTION(passthru)
int arg_count = ZEND_NUM_ARGS(); int arg_count = ZEND_NUM_ARGS();
int ret; int ret;
if (arg_count > 2 || zend_get_parameters_ex(arg_count, &arg1, &arg2) == FAILURE) { if (arg_count < 1 || arg_count > 2 || zend_get_parameters_ex(arg_count, &arg1, &arg2) == FAILURE) {
WRONG_PARAM_COUNT; WRONG_PARAM_COUNT;
} }
if (!Z_STRLEN_PP(arg1)) {
PHP_EMPTY_EXEC_PARAM;
}
switch (arg_count) { switch (arg_count) {
case 1: case 1:
ret = php_Exec(3, Z_STRVAL_PP(arg1), NULL, return_value TSRMLS_CC); ret = php_Exec(3, Z_STRVAL_PP(arg1), NULL, return_value TSRMLS_CC);

2
ext/standard/exec.h
View file

@ -35,4 +35,6 @@ char *php_escape_shell_cmd(char *);
char *php_escape_shell_arg(char *); char *php_escape_shell_arg(char *);
int php_Exec(int type, char *cmd, pval *array, pval *return_value TSRMLS_DC); int php_Exec(int type, char *cmd, pval *array, pval *return_value TSRMLS_DC);
#define PHP_EMPTY_EXEC_PARAM { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot execute a blank command"); RETURN_FALSE; }
#endif /* EXEC_H */ #endif /* EXEC_H */