Skip to content

Commit 19350b6

Browse files
devnexensmalyshev
authored andcommitted
phpdbg: couple of network function return checks. Possible
overflow when copy the socket_path configuration.
1 parent a2fdf0f commit 19350b6

File tree

2 files changed

+17
-2
lines changed

2 files changed

+17
-2
lines changed

ext/session/mod_files.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,7 @@ static int ps_files_cleanup_dir(const char *dirname, zend_long maxlifetime)
296296

297297
if (dirname_len >= MAXPATHLEN) {
298298
php_error_docref(NULL, E_NOTICE, "ps_files_cleanup_dir: dirname(%s) is too long", dirname);
299+
closedir(dir);
299300
return (0);
300301
}
301302

sapi/phpdbg/phpdbg_wait.c

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -248,8 +248,10 @@ void phpdbg_webdata_decompress(char *msg, int len) {
248248
extension = (zend_extension *) zend_llist_get_first_ex(&zend_extensions, &pos);
249249
while (extension) {
250250
extension = (zend_extension *) zend_llist_get_next_ex(&zend_extensions, &pos);
251+
if (extension == NULL){
252+
break;
253+
}
251254

252-
/* php_serach_array() body should be in some ZEND_API function... */
253255
ZEND_HASH_FOREACH_STR_KEY_PTR(Z_ARRVAL_P(zvp), strkey, name) {
254256
if (Z_TYPE_P(name) == IS_STRING && !zend_binary_strcmp(extension->name, strlen(extension->name), Z_STRVAL_P(name), Z_STRLEN_P(name))) {
255257
break;
@@ -344,9 +346,16 @@ PHPDBG_COMMAND(wait) /* {{{ */
344346
if (PHPDBG_G(socket_server_fd) == -1) {
345347
int len;
346348
PHPDBG_G(socket_server_fd) = sl = socket(AF_UNIX, SOCK_STREAM, 0);
349+
if (sl == -1) {
350+
phpdbg_error("wait", "type=\"nosocket\" import=\"fail\"", "Unable to open a socket to UNIX domain socket at %s defined by phpdbg.path ini setting", PHPDBG_G(socket_path));
351+
return FAILURE;
352+
}
347353

348354
local.sun_family = AF_UNIX;
349-
strcpy(local.sun_path, PHPDBG_G(socket_path));
355+
if (strlcpy(local.sun_path, PHPDBG_G(socket_path), sizeof(local.sun_path)) > sizeof(local.sun_path)) {
356+
phpdbg_error("wait", "type=\"nosocket\" import=\"fail\"", "Socket at %s defined by phpdbg.path ini setting is too long", PHPDBG_G(socket_path));
357+
return FAILURE;
358+
}
350359
len = strlen(local.sun_path) + sizeof(local.sun_family);
351360
if (bind(sl, (struct sockaddr *)&local, len) == -1) {
352361
phpdbg_error("wait", "type=\"nosocket\" import=\"fail\"", "Unable to connect to UNIX domain socket at %s defined by phpdbg.path ini setting", PHPDBG_G(socket_path));
@@ -362,6 +371,11 @@ PHPDBG_COMMAND(wait) /* {{{ */
362371

363372
rlen = sizeof(remote);
364373
sr = accept(sl, (struct sockaddr *) &remote, (socklen_t *) &rlen);
374+
if (sr == -1) {
375+
phpdbg_error("wait", "type=\"nosocket\" import=\"fail\"", "Unable to create a connection to UNIX domain socket at %s defined by phpdbg.path ini setting", PHPDBG_G(socket_path));
376+
close(PHPDBG_G(socket_server_fd));
377+
return FAILURE;
378+
}
365379

366380
char msglen[5];
367381
int recvd = 4;

0 commit comments

Comments
 (0)