archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix array overrun when appending slash to paths

Browse source 
Fix it by extending the array sizes by one character. As the input is
limited to the maximum path length, there will always be place to append
the slash. As the php_check_specific_open_basedir() simply uses the
strings to compare against each other, no new failures related to too
long paths are introduced.
We'll let the DOM and XML case handle a potentially too long path in the
library code.
This commit is contained in:
Niels Dossche 2023-01-27 19:28:27 +01:00 • committed by Ben Ramsey
parent 8ef9294248
commit c0fceebfa1
No known key found for this signature in database
GPG key ID: F9C39DC0B9698544
3 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/dom/document.c
View file

@ -1182,7 +1182,7 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, size_t so
int validate, recover, resolve_externals, keep_blanks, substitute_ent;
int resolved_path_len;
int old_error_reporting = 0;
char *directory=NULL, resolved_path[MAXPATHLEN];
char *directory=NULL, resolved_path[MAXPATHLEN + 1];
if (id != NULL) {
intern = Z_DOMOBJ_P(id);

2
ext/xmlreader/php_xmlreader.c
View file

@ -1017,7 +1017,7 @@ PHP_METHOD(XMLReader, XML)
xmlreader_object *intern = NULL;
char *source, *uri = NULL, *encoding = NULL;
int resolved_path_len, ret = 0;
char *directory=NULL, resolved_path[MAXPATHLEN];
char *directory=NULL, resolved_path[MAXPATHLEN + 1];
xmlParserInputBufferPtr inputbfr;
xmlTextReaderPtr reader;

6
main/fopen_wrappers.c
View file

@ -129,10 +129,10 @@ PHPAPI ZEND_INI_MH(OnUpdateBaseDir)
*/
PHPAPI int php_check_specific_open_basedir(const char *basedir, const char *path)
{
char resolved_name[MAXPATHLEN];
char resolved_basedir[MAXPATHLEN];
char resolved_name[MAXPATHLEN + 1];
char resolved_basedir[MAXPATHLEN + 1];
char local_open_basedir[MAXPATHLEN];
char path_tmp[MAXPATHLEN];
char path_tmp[MAXPATHLEN + 1];
char *path_file;
size_t resolved_basedir_len;
size_t resolved_name_len;