File: 116-CVE-2007-0906_streams.patch

package info (click to toggle)
php5 5.2.0-8%2Betch1
  • links: PTS
  • area: main
  • in suites: etch-m68k
  • size: 58,836 kB
  • ctags: 45,575
  • sloc: ansic: 535,107; sh: 17,819; php: 11,336; cpp: 4,289; xml: 3,861; yacc: 2,446; lex: 2,174; makefile: 1,150; tcl: 1,128; awk: 693; perl: 71; sql: 22; pascal: 15
file content (101 lines) | stat: -rw-r--r-- 3,969 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
diff -Nru old/ext/standard/streamsfuncs.c new/ext/standard/streamsfuncs.c
--- old/ext/standard/streamsfuncs.c	2006-10-12 01:22:45.000000000 +0200
+++ new/ext/standard/streamsfuncs.c	2007-03-07 21:39:55.000000000 +0100
@@ -361,7 +361,7 @@
 		RETURN_FALSE;
 	}
 	
-	read_buf = emalloc(to_read + 1);
+	read_buf = safe_emalloc(1, to_read, 1);
 	
 	recvd = php_stream_xport_recvfrom(stream, read_buf, to_read, flags, NULL, NULL,
 			zremote ? &Z_STRVAL_P(zremote) : NULL,
@@ -530,7 +530,7 @@
 		while (zend_hash_get_current_key_ex(stream_xport_hash,
 					&stream_xport, &stream_xport_len,
 					&num_key, 0, NULL) == HASH_KEY_IS_STRING) {
-			add_next_index_stringl(return_value, stream_xport, stream_xport_len, 1);
+			add_next_index_stringl(return_value, stream_xport, stream_xport_len - 1, 1);
 			zend_hash_move_forward(stream_xport_hash);
 		}
 	} else {
@@ -558,7 +558,7 @@
 			(key_flags = zend_hash_get_current_key_ex(url_stream_wrappers_hash, &stream_protocol, &stream_protocol_len, &num_key, 0, NULL)) != HASH_KEY_NON_EXISTANT;
 			zend_hash_move_forward(url_stream_wrappers_hash)) {
 				if (key_flags == HASH_KEY_IS_STRING) {
-					add_next_index_stringl(return_value, stream_protocol, stream_protocol_len, 1);
+					add_next_index_stringl(return_value, stream_protocol, stream_protocol_len - 1, 1);
 				}
 		}
 	} else {
diff -Nru old/main/streams/streams.c new/main/streams/streams.c
--- old/main/streams/streams.c	2006-10-03 21:51:01.000000000 +0200
+++ new/main/streams/streams.c	2007-03-07 21:44:53.000000000 +0100
@@ -1449,12 +1449,12 @@
 		return FAILURE;
 	}
 
-	return zend_hash_add(&url_stream_wrappers_hash, protocol, protocol_len, &wrapper, sizeof(wrapper), NULL);
+	return zend_hash_add(&url_stream_wrappers_hash, protocol, protocol_len + 1, &wrapper, sizeof(wrapper), NULL);
 }
 
 PHPAPI int php_unregister_url_stream_wrapper(char *protocol TSRMLS_DC)
 {
-	return zend_hash_del(&url_stream_wrappers_hash, protocol, strlen(protocol));
+	return zend_hash_del(&url_stream_wrappers_hash, protocol, strlen(protocol) + 1);
 }
 
 static void clone_wrapper_hash(TSRMLS_D)
@@ -1479,7 +1479,7 @@
 		clone_wrapper_hash(TSRMLS_C);
 	}
 
-	return zend_hash_add(FG(stream_wrappers), protocol, protocol_len, &wrapper, sizeof(wrapper), NULL);
+	return zend_hash_add(FG(stream_wrappers), protocol, protocol_len + 1, &wrapper, sizeof(wrapper), NULL);
 }
 
 PHPAPI int php_unregister_url_stream_wrapper_volatile(char *protocol TSRMLS_DC)
@@ -1488,7 +1488,7 @@
 		clone_wrapper_hash(TSRMLS_C);
 	}
 
-	return zend_hash_del(FG(stream_wrappers), protocol, strlen(protocol));
+	return zend_hash_del(FG(stream_wrappers), protocol, strlen(protocol) + 1);
 }
 /* }}} */
 
@@ -1521,11 +1521,11 @@
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Use of \"zlib:\" wrapper is deprecated; please use \"compress.zlib://\" instead.");
 	}
 
-	if (protocol)	{
-		if (FAILURE == zend_hash_find(wrapper_hash, (char*)protocol, n, (void**)&wrapperpp)) {
-			char *tmp = estrndup(protocol, n);
+	if (protocol) {
+		char *tmp = estrndup(protocol, n);
+		if (FAILURE == zend_hash_find(wrapper_hash, (char*)tmp, n + 1, (void**)&wrapperpp)) {
 			php_strtolower(tmp, n);
-			if (FAILURE == zend_hash_find(wrapper_hash, (char*)tmp, n, (void**)&wrapperpp)) {
+			if (FAILURE == zend_hash_find(wrapper_hash, (char*)tmp, n + 1, (void**)&wrapperpp)) {
 				char wrapper_name[32];
 
 				if (n >= sizeof(wrapper_name)) {
@@ -1538,8 +1538,8 @@
 				wrapperpp = NULL;
 				protocol = NULL;
 			}
-			efree(tmp);
 		}
+		efree(tmp);
 	}
 	/* TODO: curl based streams probably support file:// properly */
 	if (!protocol || !strncasecmp(protocol, "file", n))	{
@@ -1588,7 +1588,7 @@
 			}
 			
 			/* Check again, the original check might have not known the protocol name */
-			if (zend_hash_find(wrapper_hash, "file", sizeof("file")-1, (void**)&wrapperpp) == SUCCESS) {
+			if (zend_hash_find(wrapper_hash, "file", sizeof("file"), (void**)&wrapperpp) == SUCCESS) {
 				return *wrapperpp;
 			}