Skip to content
Browse files

Merge remote branch 'security/PHP-5.3' into PHP-5.3

* security/PHP-5.3:
  fix bug #61367 - open_basedir bypass using libxml RSHUTDOWN
  open_basedir check for linkinfo
  NEWS entry for readline fix
  Add open_basedir checks to readline_write_history and readline_read_history
  • Loading branch information...
2 parents 67bf07f + 167e2fd commit 21fa9634c19210050b130bed9f3ac77c5332080b @johannes johannes committed Mar 29, 2012
Showing with 137 additions and 6 deletions.
  1. +6 −0 NEWS
  2. +5 −5 ext/libxml/libxml.c
  3. +58 −0 ext/libxml/tests/bug61367-read.phpt
  4. +48 −0 ext/libxml/tests/bug61367-write.phpt
  5. +8 −0 ext/readline/readline.c
  6. +12 −1 ext/standard/link.c
View
6 NEWS
@@ -54,6 +54,10 @@ PHP NEWS
- Firebird Database extension (ibase):
. Fixed bug #60802 (ibase_trans() gives segfault when passing params).
+- Libxml:
+ . Fixed bug #61367 (open_basedir bypass using libxml RSHUTDOWN).
+ (Tim Starling)
+
- mysqli
. Fixed bug #61003 (mysql_stat() require a valid connection). (Johannes).
@@ -83,6 +87,8 @@ PHP NEWS
- Readline:
. Fixed bug #61088 (Memory leak in readline_callback_handler_install).
(Nikic, Laruence)
+ . Add open_basedir checks to readline_write_history and readline_read_history.
+ (Rasmus, reported by Mateusz Goik)
- Reflection:
. Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads
View
10 ext/libxml/libxml.c
@@ -82,8 +82,8 @@ ZEND_GET_MODULE(libxml)
static PHP_MINIT_FUNCTION(libxml);
static PHP_RINIT_FUNCTION(libxml);
static PHP_MSHUTDOWN_FUNCTION(libxml);
-static PHP_RSHUTDOWN_FUNCTION(libxml);
static PHP_MINFO_FUNCTION(libxml);
+static int php_libxml_post_deactivate();
/* }}} */
@@ -129,13 +129,13 @@ zend_module_entry libxml_module_entry = {
PHP_MINIT(libxml), /* extension-wide startup function */
PHP_MSHUTDOWN(libxml), /* extension-wide shutdown function */
PHP_RINIT(libxml), /* per-request startup function */
- PHP_RSHUTDOWN(libxml), /* per-request shutdown function */
+ NULL, /* per-request shutdown function */
PHP_MINFO(libxml), /* information function */
NO_VERSION_YET,
PHP_MODULE_GLOBALS(libxml), /* globals descriptor */
PHP_GINIT(libxml), /* globals ctor */
NULL, /* globals dtor */
- NULL, /* post deactivate */
+ php_libxml_post_deactivate, /* post deactivate */
STANDARD_MODULE_PROPERTIES_EX
};
@@ -655,9 +655,9 @@ static PHP_MSHUTDOWN_FUNCTION(libxml)
return SUCCESS;
}
-
-static PHP_RSHUTDOWN_FUNCTION(libxml)
+static int php_libxml_post_deactivate()
{
+ TSRMLS_FETCH();
/* reset libxml generic error handling */
xmlSetGenericErrorFunc(NULL, NULL);
xmlSetStructuredErrorFunc(NULL, NULL);
View
58 ext/libxml/tests/bug61367-read.phpt
@@ -0,0 +1,58 @@
+--TEST--
+Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test
+--SKIPIF--
+<?php if(!extension_loaded('dom')) echo 'skip'; ?>
+--INI--
+open_basedir=.
+; Suppress spurious "Trying to get property of non-object" notices
+error_reporting=E_ALL & ~E_NOTICE
+--FILE--
+<?php
+
+class StreamExploiter {
+ public function stream_close ( ) {
+ $doc = new DOMDocument;
+ $doc->resolveExternals = true;
+ $doc->substituteEntities = true;
+ $dir = htmlspecialchars(dirname(getcwd()));
+ $doc->loadXML( <<<XML
+<!DOCTYPE doc [
+ <!ENTITY file SYSTEM "file:///$dir/bad">
+]>
+<doc>&file;</doc>
+XML
+ );
+ print $doc->documentElement->firstChild->nodeValue;
+ }
+
+ public function stream_open ( $path , $mode , $options , &$opened_path ) {
+ return true;
+ }
+}
+
+var_dump(mkdir('test_bug_61367'));
+var_dump(mkdir('test_bug_61367/base'));
+var_dump(file_put_contents('test_bug_61367/bad', 'blah'));
+var_dump(chdir('test_bug_61367/base'));
+
+stream_wrapper_register( 'exploit', 'StreamExploiter' );
+$s = fopen( 'exploit://', 'r' );
+
+?>
+--CLEAN--
+<?php
+unlink('test_bug_61367/bad');
+rmdir('test_bug_61367/base');
+rmdir('test_bug_61367');
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+int(4)
+bool(true)
+
+Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "file:///%s/test_bug_61367/bad" in %s on line %d
+
+Warning: DOMDocument::loadXML(): Failure to process entity file in Entity, line: 4 in %s on line %d
+
+Warning: DOMDocument::loadXML(): Entity 'file' not defined in Entity, line: 4 in %s on line %d
View
48 ext/libxml/tests/bug61367-write.phpt
@@ -0,0 +1,48 @@
+--TEST--
+Bug #61367: open_basedir bypass in libxml RSHUTDOWN: write test
+--SKIPIF--
+<?php if(!extension_loaded('dom')) echo 'skip'; ?>
+--INI--
+open_basedir=.
+; Suppress spurious "Trying to get property of non-object" notices
+error_reporting=E_ALL & ~E_NOTICE
+--FILE--
+<?php
+
+class StreamExploiter {
+ public function stream_close ( ) {
+ $doc = new DOMDocument;
+ $doc->appendChild($doc->createTextNode('hello'));
+ var_dump($doc->save(dirname(getcwd()) . '/bad'));
+ }
+
+ public function stream_open ( $path , $mode , $options , &$opened_path ) {
+ return true;
+ }
+}
+
+var_dump(mkdir('test_bug_61367'));
+var_dump(mkdir('test_bug_61367/base'));
+var_dump(file_put_contents('test_bug_61367/bad', 'blah'));
+var_dump(chdir('test_bug_61367/base'));
+
+stream_wrapper_register( 'exploit', 'StreamExploiter' );
+$s = fopen( 'exploit://', 'r' );
+
+?>
+--CLEAN--
+<?php
+@unlink('test_bug_61367/bad');
+rmdir('test_bug_61367/base');
+rmdir('test_bug_61367');
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+int(4)
+bool(true)
+
+Warning: DOMDocument::save(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d
+
+Warning: DOMDocument::save(%s): failed to open stream: Operation not permitted in %s on line %d
+bool(false)
View
8 ext/readline/readline.c
@@ -369,6 +369,10 @@ PHP_FUNCTION(readline_read_history)
return;
}
+ if (php_check_open_basedir(arg TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
+
/* XXX from & to NYI */
if (read_history(arg)) {
RETURN_FALSE;
@@ -389,6 +393,10 @@ PHP_FUNCTION(readline_write_history)
return;
}
+ if (php_check_open_basedir(arg TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
+
if (write_history(arg)) {
RETURN_FALSE;
} else {
View
13 ext/standard/link.c
@@ -94,20 +94,31 @@ PHP_FUNCTION(readlink)
PHP_FUNCTION(linkinfo)
{
char *link;
- int link_len;
+ char *dirname;
+ int link_len, dir_len;
struct stat sb;
int ret;
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &link, &link_len) == FAILURE) {
return;
}
+ dirname = estrndup(link, link_len);
+ dir_len = php_dirname(dirname, link_len);
+
+ if (php_check_open_basedir(dirname TSRMLS_CC)) {
+ efree(dirname);
+ RETURN_FALSE;
+ }
+
ret = VCWD_LSTAT(link, &sb);
if (ret == -1) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", strerror(errno));
+ efree(dirname);
RETURN_LONG(-1L);
}
+ efree(dirname);
RETURN_LONG((long) sb.st_dev);
}
/* }}} */

0 comments on commit 21fa963

Please sign in to comment.
Something went wrong with that request. Please try again.