archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-16812: UAF on readline_info() after readline_write_history() call.

Browse source 
close GH-16813
This commit is contained in:
David Carlier 2024-11-15 07:47:52 +00:00
parent 0ed855aa07
commit b8ba6f63a3
No known key found for this signature in database
GPG key ID: 8486F847B4B94EF1
3 changed files with 22 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NEWS
View file

@ -24,6 +24,9 @@ PHP NEWS
- PDO: - PDO:
. Fixed memory leak of `setFetchMode()`. (SakiTakamachi) . Fixed memory leak of `setFetchMode()`. (SakiTakamachi)
- Readline:
. Fixed UAF with readline_info(). (David Carlier)
- Reflection: - Reflection:
. Fixed the name of the second parameter of . Fixed the name of the second parameter of
ReflectionClass::resetAsLazyGhost(). (Arnaud) ReflectionClass::resetAsLazyGhost(). (Arnaud)

6
ext/readline/readline.c
View file

@ -181,7 +181,7 @@ PHP_FUNCTION(readline_info)
add_assoc_long(return_value,"attempted_completion_over",rl_attempted_completion_over); add_assoc_long(return_value,"attempted_completion_over",rl_attempted_completion_over);
} else { } else {
if (zend_string_equals_literal_ci(what,"line_buffer")) { if (zend_string_equals_literal_ci(what,"line_buffer")) {
oldstr = rl_line_buffer; oldstr = strdup(rl_line_buffer ? rl_line_buffer : "");
if (value) { if (value) {
if (!try_convert_to_string(value)) { if (!try_convert_to_string(value)) {
RETURN_THROWS(); RETURN_THROWS();
@ -191,7 +191,8 @@ PHP_FUNCTION(readline_info)
rl_line_buffer = malloc(Z_STRLEN_P(value) + 1); rl_line_buffer = malloc(Z_STRLEN_P(value) + 1);
} else if (strlen(oldstr) < Z_STRLEN_P(value)) { } else if (strlen(oldstr) < Z_STRLEN_P(value)) {
rl_extend_line_buffer(Z_STRLEN_P(value) + 1); rl_extend_line_buffer(Z_STRLEN_P(value) + 1);
oldstr = rl_line_buffer; free(oldstr);
oldstr = strdup(rl_line_buffer ? rl_line_buffer : "");
} }
memcpy(rl_line_buffer, Z_STRVAL_P(value), Z_STRLEN_P(value) + 1); memcpy(rl_line_buffer, Z_STRVAL_P(value), Z_STRLEN_P(value) + 1);
#else #else
@ -208,6 +209,7 @@ PHP_FUNCTION(readline_info)
#endif #endif
} }
RETVAL_STRING(SAFE_STRING(oldstr)); RETVAL_STRING(SAFE_STRING(oldstr));
free(oldstr);
} else if (zend_string_equals_literal_ci(what, "point")) { } else if (zend_string_equals_literal_ci(what, "point")) {
RETVAL_LONG(rl_point); RETVAL_LONG(rl_point);
#ifndef PHP_WIN32 #ifndef PHP_WIN32

15
ext/readline/tests/gh16812.phpt Normal file
View file

@ -0,0 +1,15 @@
--TEST--
GH-16812 readline_info(): UAF
--EXTENSIONS--
readline
--SKIPIF--
<?php
if (getenv('SKIP_REPEAT')) die("skip readline has global state");
?>
--FILE--
<?php
readline_write_history(NULL);
var_dump(readline_info('line_buffer', 'test'));
?>
--EXPECT--
string(0) ""