Skip to content

Commit 86537f9

Browse files
iluuu1994ericmann
iluuu1994
authored and
ericmann
committed
GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to ctype.h functions
Fixes GHSA-m8rr-4c36-8gq4 Fixes CVE-2026-7258
1 parent ab97806 commit 86537f9

58 files changed

Lines changed: 183 additions & 183 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Zend/zend_compile.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2102,7 +2102,7 @@ ZEND_API size_t zend_dirname(char *path, size_t len)
21022102
/* Note that on Win32 CWD is per drive (heritage from CP/M).
21032103
* This means dirname("c:foo") maps to "c:." or "c:" - which means CWD on C: drive.
21042104
*/
2105-
if ((2 <= len) && isalpha((int)((unsigned char *)path)[0]) && (':' == path[1])) {
2105+
if ((2 <= len) && isalpha((unsigned char)path[0]) && (':' == path[1])) {
21062106
/* Skip over the drive spec (if any) so as not to change */
21072107
path += 2;
21082108
len_adjust += 2;

‎Zend/zend_ini.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -595,7 +595,7 @@ static const char *zend_ini_consume_quantity_prefix(const char *const digits, co
595595
++digits_consumed;
596596
}
597597

598-
if (digits_consumed[0] == '0' && !isdigit(digits_consumed[1])) {
598+
if (digits_consumed[0] == '0' && !isdigit((unsigned char)digits_consumed[1])) {
599599
/* Value is just 0 */
600600
if ((digits_consumed+1) == str_end) {
601601
return digits_consumed;
@@ -653,7 +653,7 @@ static zend_ulong zend_ini_parse_quantity_internal(zend_string *value, zend_ini_
653653
}
654654

655655
/* if there is no digit after +/- */
656-
if (!isdigit(digits[0])) {
656+
if (!isdigit((unsigned char)digits[0])) {
657657
/* Escape the string to avoid null bytes and to make non-printable chars
658658
* visible */
659659
smart_str_append_escaped(&invalid, ZSTR_VAL(value), ZSTR_LEN(value));
@@ -667,7 +667,7 @@ static zend_ulong zend_ini_parse_quantity_internal(zend_string *value, zend_ini_
667667
}
668668

669669
int base = 0;
670-
if (digits[0] == '0' && !isdigit(digits[1])) {
670+
if (digits[0] == '0' && !isdigit((unsigned char)digits[1])) {
671671
/* Value is just 0 */
672672
if ((digits+1) == str_end) {
673673
*errstr = NULL;

‎Zend/zend_operators.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3233,8 +3233,8 @@ ZEND_API int ZEND_FASTCALL zend_binary_strcasecmp_l(const char *s1, size_t len1,
32333233

32343234
len = MIN(len1, len2);
32353235
while (len--) {
3236-
c1 = zend_tolower((int)*(unsigned char *)s1++);
3237-
c2 = zend_tolower((int)*(unsigned char *)s2++);
3236+
c1 = zend_tolower((unsigned char)*(s1++));
3237+
c2 = zend_tolower((unsigned char)*(s2++));
32383238
if (c1 != c2) {
32393239
return c1 - c2;
32403240
}
@@ -3254,8 +3254,8 @@ ZEND_API int ZEND_FASTCALL zend_binary_strncasecmp_l(const char *s1, size_t len1
32543254
}
32553255
len = MIN(length, MIN(len1, len2));
32563256
while (len--) {
3257-
c1 = zend_tolower((int)*(unsigned char *)s1++);
3258-
c2 = zend_tolower((int)*(unsigned char *)s2++);
3257+
c1 = zend_tolower((unsigned char)*(s1++));
3258+
c2 = zend_tolower((unsigned char)*(s2++));
32593259
if (c1 != c2) {
32603260
return c1 - c2;
32613261
}

‎Zend/zend_virtual_cwd.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ void virtual_cwd_main_cwd_init(uint8_t reinit) /* {{{ */
195195
main_cwd_state.cwd_length = strlen(cwd);
196196
#ifdef ZEND_WIN32
197197
if (main_cwd_state.cwd_length >= 2 && cwd[1] == ':') {
198-
cwd[0] = toupper(cwd[0]);
198+
cwd[0] = toupper((unsigned char)cwd[0]);
199199
}
200200
#endif
201201
main_cwd_state.cwd = strdup(cwd);
@@ -273,7 +273,7 @@ CWD_API char *virtual_getcwd_ex(size_t *length) /* {{{ */
273273
*length = state->cwd_length+1;
274274
retval = (char *) emalloc(*length+1);
275275
memcpy(retval, state->cwd, *length);
276-
retval[0] = toupper(retval[0]);
276+
retval[0] = toupper((unsigned char)retval[0]);
277277
retval[*length-1] = DEFAULT_SLASH;
278278
retval[*length] = '\0';
279279
return retval;
@@ -1115,21 +1115,21 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
11151115
if (resolved_path[start] == 0) {
11161116
goto verify;
11171117
}
1118-
resolved_path[start] = toupper(resolved_path[start]);
1118+
resolved_path[start] = toupper((unsigned char)resolved_path[start]);
11191119
start++;
11201120
}
11211121
resolved_path[start++] = DEFAULT_SLASH;
11221122
while (!IS_SLASH(resolved_path[start])) {
11231123
if (resolved_path[start] == 0) {
11241124
goto verify;
11251125
}
1126-
resolved_path[start] = toupper(resolved_path[start]);
1126+
resolved_path[start] = toupper((unsigned char)resolved_path[start]);
11271127
start++;
11281128
}
11291129
resolved_path[start++] = DEFAULT_SLASH;
11301130
} else if (IS_ABSOLUTE_PATH(resolved_path, path_length)) {
11311131
/* skip DRIVE name */
1132-
resolved_path[0] = toupper(resolved_path[0]);
1132+
resolved_path[0] = toupper((unsigned char)resolved_path[0]);
11331133
resolved_path[2] = DEFAULT_SLASH;
11341134
if (path_length == 2) {
11351135
resolved_path[3] = '\0';

‎Zend/zend_virtual_cwd.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ typedef unsigned short mode_t;
8585
#define IS_UNC_PATH(path, len) \
8686
(len >= 2 && IS_SLASH(path[0]) && IS_SLASH(path[1]))
8787
#define IS_ABSOLUTE_PATH(path, len) \
88-
(len >= 2 && (/* is local */isalpha(path[0]) && path[1] == ':' || /* is UNC */IS_SLASH(path[0]) && IS_SLASH(path[1])))
88+
(len >= 2 && (/* is local */isalpha((unsigned char)(path)[0]) && path[1] == ':' || /* is UNC */IS_SLASH(path[0]) && IS_SLASH(path[1])))
8989

9090
#else
9191
#ifdef HAVE_DIRENT_H

‎ext/com_dotnet/com_extension.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -118,11 +118,11 @@ static PHP_INI_MH(OnTypeLibFileUpdate)
118118
}
119119

120120
/* Remove leading/training white spaces on search_string */
121-
while (isspace(*typelib_name)) {/* Ends on '\0' in worst case */
121+
while (isspace((unsigned char)*typelib_name)) {/* Ends on '\0' in worst case */
122122
typelib_name ++;
123123
}
124124
ptr = typelib_name + strlen(typelib_name) - 1;
125-
while ((ptr != typelib_name) && isspace(*ptr)) {
125+
while ((ptr != typelib_name) && isspace((unsigned char)*ptr)) {
126126
*ptr = '\0';
127127
ptr--;
128128
}

‎ext/date/lib/parse_date.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -511,7 +511,7 @@ static timelib_sll timelib_get_nr(const char **ptr, int max_length)
511511

512512
static void timelib_skip_day_suffix(const char **ptr)
513513
{
514-
if (isspace(**ptr)) {
514+
if (isspace((unsigned char)**ptr)) {
515515
return;
516516
}
517517
if (!timelib_strncasecmp(*ptr, "nd", 2) || !timelib_strncasecmp(*ptr, "rd", 2) ||!timelib_strncasecmp(*ptr, "st", 2) || !timelib_strncasecmp(*ptr, "th", 2)) {
@@ -852,7 +852,7 @@ static timelib_long timelib_parse_tz_cor(const char **ptr, int *tz_not_found)
852852

853853
*tz_not_found = 1;
854854

855-
while (isdigit(**ptr) || **ptr == ':') {
855+
while (isdigit((unsigned char)**ptr) || **ptr == ':') {
856856
++*ptr;
857857
}
858858
end = *ptr;
@@ -917,7 +917,7 @@ static timelib_long timelib_parse_tz_minutes(const char **ptr, timelib_time *t)
917917
}
918918

919919
++*ptr;
920-
while (isdigit(**ptr)) {
920+
while (isdigit((unsigned char)**ptr)) {
921921
++*ptr;
922922
}
923923

@@ -24863,10 +24863,10 @@ timelib_time *timelib_strtotime(const char *s, size_t len, timelib_error_contain
2486324863
in.errors->error_messages = NULL;
2486424864

2486524865
if (len > 0) {
24866-
while (isspace(*s) && s < e) {
24866+
while (isspace((unsigned char)*s) && s < e) {
2486724867
s++;
2486824868
}
24869-
while (isspace(*e) && e > s) {
24869+
while (isspace((unsigned char)*e) && e > s) {
2487024870
e--;
2487124871
}
2487224872
}

‎ext/date/lib/parse_date.re‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -509,7 +509,7 @@ static timelib_sll timelib_get_nr(const char **ptr, int max_length)
509509

510510
static void timelib_skip_day_suffix(const char **ptr)
511511
{
512-
if (isspace(**ptr)) {
512+
if (isspace((unsigned char)**ptr)) {
513513
return;
514514
}
515515
if (!timelib_strncasecmp(*ptr, "nd", 2) || !timelib_strncasecmp(*ptr, "rd", 2) ||!timelib_strncasecmp(*ptr, "st", 2) || !timelib_strncasecmp(*ptr, "th", 2)) {
@@ -850,7 +850,7 @@ static timelib_long timelib_parse_tz_cor(const char **ptr, int *tz_not_found)
850850

851851
*tz_not_found = 1;
852852

853-
while (isdigit(**ptr) || **ptr == ':') {
853+
while (isdigit((unsigned char)**ptr) || **ptr == ':') {
854854
++*ptr;
855855
}
856856
end = *ptr;
@@ -915,7 +915,7 @@ static timelib_long timelib_parse_tz_minutes(const char **ptr, timelib_time *t)
915915
}
916916

917917
++*ptr;
918-
while (isdigit(**ptr)) {
918+
while (isdigit((unsigned char)**ptr)) {
919919
++*ptr;
920920
}
921921

@@ -2013,10 +2013,10 @@ timelib_time *timelib_strtotime(const char *s, size_t len, timelib_error_contain
20132013
in.errors->error_messages = NULL;
20142014

20152015
if (len > 0) {
2016-
while (isspace(*s) && s < e) {
2016+
while (isspace((unsigned char)*s) && s < e) {
20172017
s++;
20182018
}
2019-
while (isspace(*e) && e > s) {
2019+
while (isspace((unsigned char)*e) && e > s) {
20202020
e--;
20212021
}
20222022
}

‎ext/date/lib/parse_iso_intervals.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -985,10 +985,10 @@ void timelib_strtointerval(const char *s, size_t len,
985985
in.errors->error_messages = NULL;
986986

987987
if (len > 0) {
988-
while (isspace(*s) && s < e) {
988+
while (isspace((unsigned char)*s) && s < e) {
989989
s++;
990990
}
991-
while (isspace(*e) && e > s) {
991+
while (isspace((unsigned char)*e) && e > s) {
992992
e--;
993993
}
994994
}

‎ext/date/lib/parse_iso_intervals.re‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -343,10 +343,10 @@ void timelib_strtointerval(const char *s, size_t len,
343343
in.errors->error_messages = NULL;
344344

345345
if (len > 0) {
346-
while (isspace(*s) && s < e) {
346+
while (isspace((unsigned char)*s) && s < e) {
347347
s++;
348348
}
349-
while (isspace(*e) && e > s) {
349+
while (isspace((unsigned char)*e) && e > s) {
350350
e--;
351351
}
352352
}

0 commit comments

Comments
 (0)