File: 132-CVE-2007-5899.patch

package info (click to toggle)
php5 5.2.0%2Bdfsg-8%2Betch16
  • links: PTS
  • area: main
  • in suites: etch
  • size: 58,940 kB
  • ctags: 45,388
  • sloc: ansic: 533,605; sh: 17,835; php: 11,336; cpp: 4,289; xml: 3,809; yacc: 2,446; lex: 2,174; makefile: 1,150; tcl: 1,128; awk: 693; perl: 71; sql: 22; pascal: 15
file content (51 lines) | stat: -rw-r--r-- 1,386 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/url_scanner_ex.re?r1=1.76.2.2.2.1&r2=1.76.2.2.2.2&view=patch
--- old/ext/standard/url_scanner_ex.re	2007/06/06 00:00:27	1.76.2.2.2.1
+++ new/ext/standard/url_scanner_ex.re	2007/10/10 00:35:52	1.76.2.2.2.2
@@ -205,24 +205,35 @@
 
 	if (ctx->form_app.len > 0) {
 		switch (ctx->tag.len) {
-
-#define RECOGNIZE(x) do { 	\
-	case sizeof(x)-1: \
-		if (strncasecmp(ctx->tag.c, x, sizeof(x)-1) == 0) \
-			doit = 1; \
-		break; \
-} while (0)
-		
-			RECOGNIZE("form");
-			RECOGNIZE("fieldset");
+			case sizeof("form") - 1:
+				if (!strncasecmp(ctx->tag.c, "form", sizeof("form") - 1)) {
+					doit = 1;		
+				}
+				if (doit && ctx->val.c && ctx->lookup_data && *ctx->lookup_data) {
+					char *e, *p = zend_memnstr(ctx->val.c, "://", sizeof("://") - 1, ctx->val.c + ctx->val.len);
+					if (p) {
+						e = memchr(p, '/', (ctx->val.c + ctx->val.len) - p);
+						if (!e) {
+							e = ctx->val.c + ctx->val.len;
+						}
+						if ((e - p) && strncasecmp(p, ctx->lookup_data, (e - p))) {
+							doit = 0;
+						}
+					}
+				}
+				break;
+
+			case sizeof("fieldset") - 1:
+				if (!strncasecmp(ctx->tag.c, "fieldset", sizeof("fieldset") - 1)) {
+					doit = 1;		
+				}
+				break;
 		}
 
 		if (doit)
 			smart_str_append(&ctx->result, &ctx->form_app);
 	}
 }
-
-
 
 /*
  *  HANDLE_TAG copies the HTML Tag and checks whether we