Skip to content

Commit 9bbd995

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-5.5-security' into PHP-5.5.24
* PHP-5.5-security: (22 commits) Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER) Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4) Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault) updated NEWS added test for bug #69354 revert skipif, this should run everywhere further ODBC 3.0 compliance more compliance with the ODBC 3.0 test fixes Prevent GC from changing zval or object 'color' before they are actually inserted into possible roots buffer. sigh, can't even copypaste without screwing up oop, put both the error number and message for both db object to the error message test fixes Fixed bug #69281 (opcache_is_script_cached no longer works) Fix typo: unitialized -> uninitialized Fix typo: unitialized -> uninitialized Fixed bug #68739 (Missing break / control flow). Fixed bug #68740 (NULL Pointer Dereference). Fixed bug #68677 (Use After Free). Fixed bug #68739 (Missing break / control flow in curl) Fixed bug #68740 (NULL Pointer Dereference) Fixed bug #68677 (Use After Free in OPcache) ... Conflicts: configure.in ext/curl/tests/bug69316.phpt main/php_version.h
2 parents 0cb9d75 + d19842f commit 9bbd995

20 files changed

+109
-33
lines changed

‎Zend/tests/bug43201.phpt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
--TEST--
2-
Bug #43201 (Crash on using unitialized vals and __get/__set)
2+
Bug #43201 (Crash on using uninitialized vals and __get/__set)
33
--FILE--
44
<?php
55
class Foo {

‎Zend/zend_gc.c

+2-7
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
147147
GC_BENCH_INC(zval_possible_root);
148148

149149
if (GC_ZVAL_GET_COLOR(zv) != GC_PURPLE) {
150-
GC_ZVAL_SET_PURPLE(zv);
151-
152150
if (!GC_ZVAL_ADDRESS(zv)) {
153151
gc_root_buffer *newRoot = GC_G(unused);
154152

@@ -159,7 +157,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
159157
GC_G(first_unused)++;
160158
} else {
161159
if (!GC_G(gc_enabled)) {
162-
GC_ZVAL_SET_BLACK(zv);
163160
return;
164161
}
165162
zv->refcount__gc++;
@@ -169,10 +166,10 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
169166
if (!newRoot) {
170167
return;
171168
}
172-
GC_ZVAL_SET_PURPLE(zv);
173169
GC_G(unused) = newRoot->prev;
174170
}
175171

172+
GC_ZVAL_SET_PURPLE(zv);
176173
newRoot->next = GC_G(roots).next;
177174
newRoot->prev = &GC_G(roots);
178175
GC_G(roots).next->prev = newRoot;
@@ -203,7 +200,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
203200

204201
obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
205202
if (GC_GET_COLOR(obj->buffered) != GC_PURPLE) {
206-
GC_SET_PURPLE(obj->buffered);
207203
if (!GC_ADDRESS(obj->buffered)) {
208204
gc_root_buffer *newRoot = GC_G(unused);
209205

@@ -214,7 +210,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
214210
GC_G(first_unused)++;
215211
} else {
216212
if (!GC_G(gc_enabled)) {
217-
GC_ZVAL_SET_BLACK(zv);
218213
return;
219214
}
220215
zv->refcount__gc++;
@@ -225,10 +220,10 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
225220
return;
226221
}
227222
obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
228-
GC_SET_PURPLE(obj->buffered);
229223
GC_G(unused) = newRoot->prev;
230224
}
231225

226+
GC_SET_PURPLE(obj->buffered);
232227
newRoot->next = GC_G(roots).next;
233228
newRoot->prev = &GC_G(roots);
234229
GC_G(roots).next->prev = newRoot;

‎ext/curl/interface.c

+2
Original file line numberDiff line numberDiff line change
@@ -1420,6 +1420,7 @@ static int curl_fnmatch(void *ctx, const char *pattern, const char *string)
14201420
if (error == FAILURE) {
14211421
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_FNMATCH_FUNCTION");
14221422
} else if (retval_ptr) {
1423+
_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
14231424
if (Z_TYPE_P(retval_ptr) != IS_LONG) {
14241425
convert_to_long_ex(&retval_ptr);
14251426
}
@@ -2855,6 +2856,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
28552856
curl_easy_setopt(ch->cp, CURLOPT_SHARE, sh->share);
28562857
}
28572858
}
2859+
break;
28582860

28592861
#if LIBCURL_VERSION_NUM >= 0x071500 /* Available since 7.21.0 */
28602862
case CURLOPT_FNMATCH_FUNCTION:

‎ext/curl/tests/bug69316.phpt

+4-6
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
11
--TEST--
22
Bug #69316: Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER
33
--SKIPIF--
4-
<?php
5-
if (!extension_loaded("curl")) exit("skip curl extension not loaded");
6-
if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER')) exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
7-
?>
4+
<?php include 'skipif.inc'; ?>
85
--FILE--
96
<?php
107
function hdr_callback($ch, $data) {
@@ -18,8 +15,9 @@ if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER')) exit("skip PHP_CURL_HTTP_R
1815
}
1916
return strlen($data);
2017
}
21-
$host = getenv('PHP_CURL_HTTP_REMOTE_SERVER');
22-
18+
19+
include 'server.inc';
20+
$host = curl_cli_server_start();
2321
$temp_file = dirname(__FILE__) . '/body.tmp';
2422
$url = "{$host}/get.php?test=getpost";
2523
$ch = curl_init();

‎ext/exif/tests/bug68799.phpt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
--TEST--
2-
Bug #68799 (Free called on unitialized pointer)
2+
Bug #68799 (Free called on uninitialized pointer)
33
--SKIPIF--
44
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
55
--FILE--

‎ext/mysqli/tests/mysqli_fetch_field_flags.phpt

-2
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,6 @@ mysqli_close($link);
199199
if (!mysqli_query($link, 'DROP TABLE IF EXISTS test')) {
200200
printf("[008] %s [%d] %s\n", $column_def,
201201
mysqli_errno($link), mysqli_error($link));
202-
continue;
203202
}
204203

205204
$column_def = array('col1 CHAR(1)', 'col2 CHAR(2)','INDEX idx_col1_col2(col1, col2)');
@@ -220,7 +219,6 @@ mysqli_close($link);
220219
while ($field = mysqli_fetch_field($res)) {
221220
if (!isset($expected_flags[$field->name])) {
222221
printf("[010] Found unexpected field '%s'\n", $field->name);
223-
continue;
224222
}
225223
list($missing_flags, $unexpected_flags, $flags_found) = checkFlags($field->flags, $expected_flags[$field->name], $flags);
226224
if ($unexpected_flags)

‎ext/odbc/php_odbc.c

+6-6
Original file line numberDiff line numberDiff line change
@@ -960,9 +960,9 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
960960
charextraalloc = 0;
961961
colfieldid = SQL_COLUMN_DISPLAY_SIZE;
962962

963-
rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_NAME,
963+
rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), PHP_ODBC_DESC_BASE_COLUMN_NAME,
964964
result->values[i].name, sizeof(result->values[i].name), &colnamelen, 0);
965-
rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_TYPE,
965+
rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_TYPE,
966966
NULL, 0, NULL, &result->values[i].coltype);
967967

968968
/* Don't bind LONG / BINARY columns, so that fetch behaviour can
@@ -997,7 +997,7 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
997997
charextraalloc = 1;
998998
#endif
999999
default:
1000-
rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
1000+
rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
10011001
NULL, 0, NULL, &displaysize);
10021002
/* Workaround for Oracle ODBC Driver bug (#50162) when fetching TIMESTAMP column */
10031003
if (result->values[i].coltype == SQL_TIMESTAMP) {
@@ -1091,7 +1091,7 @@ void odbc_column_lengths(INTERNAL_FUNCTION_PARAMETERS, int type)
10911091
RETURN_FALSE;
10921092
}
10931093

1094-
SQLColAttributes(result->stmt, (SQLUSMALLINT)pv_num, (SQLUSMALLINT) (type?SQL_COLUMN_SCALE:SQL_COLUMN_PRECISION), NULL, 0, NULL, &len);
1094+
PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)pv_num, (SQLUSMALLINT) (type?SQL_COLUMN_SCALE:SQL_COLUMN_PRECISION), NULL, 0, NULL, &len);
10951095

10961096
RETURN_LONG(len);
10971097
}
@@ -2135,7 +2135,7 @@ PHP_FUNCTION(odbc_result)
21352135
fieldsize = result->longreadlen;
21362136
}
21372137
} else {
2138-
SQLColAttributes(result->stmt, (SQLUSMALLINT)(field_ind + 1),
2138+
PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(field_ind + 1),
21392139
(SQLUSMALLINT)((sql_c_type == SQL_C_BINARY) ? SQL_COLUMN_LENGTH :
21402140
SQL_COLUMN_DISPLAY_SIZE),
21412141
NULL, 0, NULL, &fieldsize);
@@ -2871,7 +2871,7 @@ PHP_FUNCTION(odbc_field_type)
28712871
RETURN_FALSE;
28722872
}
28732873

2874-
SQLColAttributes(result->stmt, (SQLUSMALLINT)pv_num, SQL_COLUMN_TYPE_NAME, tmp, 31, &tmplen, NULL);
2874+
PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)pv_num, SQL_COLUMN_TYPE_NAME, tmp, 31, &tmplen, NULL);
28752875
RETURN_STRING(tmp,1)
28762876
}
28772877
/* }}} */

‎ext/odbc/php_odbc_includes.h

+8
Original file line numberDiff line numberDiff line change
@@ -281,8 +281,16 @@ void odbc_sql_error(ODBC_SQL_ERROR_PARAMS);
281281

282282
#if defined(ODBCVER) && (ODBCVER >= 0x0300)
283283
#define IS_SQL_LONG(x) (x == SQL_LONGVARBINARY || x == SQL_LONGVARCHAR || x == SQL_WLONGVARCHAR)
284+
285+
#define PHP_ODBC_SQLCOLATTRIBUTE SQLColAttribute
286+
287+
#define PHP_ODBC_DESC_BASE_COLUMN_NAME SQL_DESC_BASE_COLUMN_NAME
284288
#else
285289
#define IS_SQL_LONG(x) (x == SQL_LONGVARBINARY || x == SQL_LONGVARCHAR)
290+
291+
#define PHP_ODBC_SQLCOLATTRIBUTE SQLColAttributes
292+
293+
#define PHP_ODBC_DESC_BASE_COLUMN_NAME SQL_COLUMN_NAME
286294
#endif
287295
#define IS_SQL_BINARY(x) (x == SQL_BINARY || x == SQL_VARBINARY || x == SQL_LONGVARBINARY)
288296

‎ext/odbc/tests/bug60616.phpt

+5
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22
odbc_exec(): Getting accurate unicode data from query
33
--SKIPIF--
44
<?php include 'skipif.inc'; ?>
5+
<?php
6+
if ("unixODBC" != ODBC_TYPE) {
7+
die("skip ODBC_TYPE != unixODBC");
8+
}
9+
?>
510
--FILE--
611
<?php
712

‎ext/odbc/tests/bug69354.phpt

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
--TEST--
2+
Bug #69354 Incorrect use of SQLColAttributes with ODBC 3.0
3+
--SKIPIF--
4+
<?php include 'skipif.inc'; ?>
5+
--FILE--
6+
<?php
7+
8+
include 'config.inc';
9+
10+
$conn = odbc_connect($dsn, $user, $pass);
11+
12+
@odbc_exec($conn, 'CREATE DATABASE odbcTEST');
13+
14+
odbc_exec($conn, 'CREATE TABLE FOO (ID INT, VARCHAR_COL VARCHAR(100))');
15+
16+
odbc_exec($conn, "INSERT INTO FOO(ID, VARCHAR_COL) VALUES (1, '" . str_repeat("a", 100) . "')");
17+
18+
$res = odbc_exec($conn,"select VARCHAR_COL from FOO");
19+
if ($res) {
20+
if (odbc_fetch_row($res)) {
21+
$ret = odbc_result($res,'varchar_col');
22+
echo strlen($ret), "\n";
23+
echo $ret[0], "\n";
24+
echo $ret[strlen($ret)-1], "\n";
25+
}
26+
}
27+
?>
28+
==DONE==
29+
--EXPECT--
30+
100
31+
a
32+
a
33+
==DONE==
34+
--CLEAN--
35+
<?php
36+
include 'config.inc';
37+
38+
$conn = odbc_connect($dsn, $user, $pass);
39+
40+
odbc_exec($conn, 'DROP TABLE FOO');
41+
odbc_exec($conn, 'DROP DATABASE odbcTEST');
42+
43+
?>

‎ext/odbc/tests/odbc_exec_001.phpt

+5
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22
odbc_exec(): Basic test
33
--SKIPIF--
44
<?php include 'skipif.inc'; ?>
5+
<?php
6+
if ("unixODBC" != ODBC_TYPE) {
7+
die("skip ODBC_TYPE != unixODBC");
8+
}
9+
?>
510
--FILE--
611
<?php
712

‎ext/odbc/tests/odbc_free_result_001.phpt

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ $conn = odbc_connect($dsn, $user, $pass);
1111

1212
odbc_exec($conn, 'CREATE DATABASE odbcTEST');
1313

14-
odbc_exec($conn, 'CREATE TABLE FOO (TEST INT)');
14+
odbc_exec($conn, 'CREATE TABLE FOO (TEST INT NOT NULL)');
1515
odbc_exec($conn, 'ALTER TABLE FOO ADD PRIMARY KEY (TEST)');
1616

1717
odbc_exec($conn, 'INSERT INTO FOO VALUES (1)');

‎ext/opcache/tests/bug69281.phpt

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Test that script cached info is correct with validate_timestamps disabled
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.validate_timestamps=0
8+
--SKIPIF--
9+
<?php require_once('skipif.inc'); ?>
10+
--FILE--
11+
<?php
12+
var_dump(opcache_is_script_cached(__FILE__));
13+
var_dump(opcache_is_script_cached("nonexistent.php"));
14+
?>
15+
--EXPECT--
16+
bool(true)
17+
bool(false)

‎ext/opcache/tests/is_script_cached.phpt

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ Test that script cached info is correct
44
opcache.enable=1
55
opcache.enable_cli=1
66
opcache.file_update_protection=0
7+
opcache.validate_timestamps=1
78
--SKIPIF--
89
<?php require_once('skipif.inc'); ?>
910
--FILE--

‎ext/opcache/zend_accelerator_module.c

+4-2
Original file line numberDiff line numberDiff line change
@@ -320,14 +320,16 @@ static int filename_is_in_cache(char *filename, int filename_len TSRMLS_DC)
320320
persistent_script = zend_accel_hash_find(&ZCSG(hash), filename, filename_len + 1);
321321
if (persistent_script) {
322322
return !persistent_script->corrupted &&
323-
validate_timestamp_and_record(persistent_script, &handle TSRMLS_CC) == SUCCESS;
323+
(!ZCG(accel_directives).validate_timestamps ||
324+
validate_timestamp_and_record(persistent_script, &handle TSRMLS_CC) == SUCCESS);
324325
}
325326
}
326327

327328
if ((key = accel_make_persistent_key_ex(&handle, filename_len, &key_length TSRMLS_CC)) != NULL) {
328329
persistent_script = zend_accel_hash_find(&ZCSG(hash), key, key_length + 1);
329330
return persistent_script && !persistent_script->corrupted &&
330-
validate_timestamp_and_record(persistent_script, &handle TSRMLS_CC) == SUCCESS;
331+
(!ZCG(accel_directives).validate_timestamps ||
332+
validate_timestamp_and_record(persistent_script, &handle TSRMLS_CC) == SUCCESS);
331333
}
332334

333335
return 0;

‎ext/opcache/zend_shared_alloc.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -346,10 +346,10 @@ void *_zend_shared_memdup(void *source, size_t size, zend_bool free_source TSRML
346346
retval = ZCG(mem);;
347347
ZCG(mem) = (void*)(((char*)ZCG(mem)) + ZEND_ALIGNED_SIZE(size));
348348
memcpy(retval, source, size);
349+
zend_shared_alloc_register_xlat_entry(source, retval);
349350
if (free_source) {
350351
interned_efree((char*)source);
351352
}
352-
zend_shared_alloc_register_xlat_entry(source, retval);
353353
return retval;
354354
}
355355

‎ext/pcre/pcrelib/pcre_exec.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -688,7 +688,7 @@ the alternative names that are used. */
688688
#define foc number
689689
#define save_mark data
690690

691-
/* These statements are here to stop the compiler complaining about unitialized
691+
/* These statements are here to stop the compiler complaining about uninitialized
692692
variables. */
693693

694694
#ifdef SUPPORT_UCP

‎ext/pdo_mysql/tests/pdo_mysql_pconnect.phpt

+5-3
Original file line numberDiff line numberDiff line change
@@ -85,10 +85,12 @@ MySQLPDOTest::skip();
8585

8686

8787
} catch (PDOException $e) {
88-
printf("[001] %s, [%s] %s\n",
88+
printf("[001] %s, [%s] %s [%s] %s\n",
8989
$e->getMessage(),
90-
(is_object($db)) ? $db->errorCode() : 'n/a',
91-
(is_object($db)) ? implode(' ', $db->errorInfo()) : 'n/a');
90+
(is_object($db1)) ? $db1->errorCode() : 'n/a',
91+
(is_object($db1)) ? implode(' ', $db1->errorInfo()) : 'n/a',
92+
(is_object($db2)) ? $db2->errorCode() : 'n/a',
93+
(is_object($db2)) ? implode(' ', $db2->errorInfo()) : 'n/a');
9294
}
9395

9496
print "done!";

‎ext/xmlwriter/php_xmlwriter.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ static void xmlwriter_free_resource_ptr(xmlwriter_object *intern TSRMLS_DC)
113113
ze_xmlwriter_object *obj = (ze_xmlwriter_object*) zend_object_store_get_object(object TSRMLS_CC); \
114114
intern = obj->xmlwriter_ptr; \
115115
if (!intern) { \
116-
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid or unitialized XMLWriter object"); \
116+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid or uninitialized XMLWriter object"); \
117117
RETURN_FALSE; \
118118
} \
119119
}

‎ext/zip/php_zip.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -417,7 +417,7 @@ static int php_zip_parse_options(zval *options, long *remove_all_path,
417417
ze_zip_object *obj = (ze_zip_object*) zend_object_store_get_object(object TSRMLS_CC); \
418418
intern = obj->za; \
419419
if (!intern) { \
420-
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid or unitialized Zip object"); \
420+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid or uninitialized Zip object"); \
421421
RETURN_FALSE; \
422422
} \
423423
}

0 commit comments

Comments
 (0)