Fix bug #79405 - gethostbyname() silently truncates after a null byte

php · Jan 4, 2021 · 8768621 · 8768621
1 parent b132da7
commit 8768621
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/ext/standard/dns.c b/ext/standard/dns.c
@@ -147,7 +147,7 @@ PHP_FUNCTION(gethostbyaddr)
 	zend_string *hostname;
 
 	ZEND_PARSE_PARAMETERS_START(1, 1)
-		Z_PARAM_STRING(addr, addr_len)
+		Z_PARAM_PATH(addr, addr_len)
 	ZEND_PARSE_PARAMETERS_END();
 
 	hostname = php_gethostbyaddr(addr);
@@ -207,7 +207,7 @@ PHP_FUNCTION(gethostbyname)
 	size_t hostname_len;
 
 	ZEND_PARSE_PARAMETERS_START(1, 1)
-		Z_PARAM_STRING(hostname, hostname_len)
+		Z_PARAM_PATH(hostname, hostname_len)
 	ZEND_PARSE_PARAMETERS_END();
 
 	if (hostname_len > MAXFQDNLEN) {
@@ -230,7 +230,7 @@ PHP_FUNCTION(gethostbynamel)
 	int i;
 
 	ZEND_PARSE_PARAMETERS_START(1, 1)
-		Z_PARAM_STRING(hostname, hostname_len)
+		Z_PARAM_PATH(hostname, hostname_len)
 	ZEND_PARSE_PARAMETERS_END();
 
 	if (hostname_len > MAXFQDNLEN) {

diff --git a/ext/standard/tests/network/bug79405.phpt b/ext/standard/tests/network/bug79405.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #76755 (setcookie does not accept "double" type for expire time)
+--FILE--
+<?php
+$host = "localhost\0.example.com";
+try {
+	var_dump(gethostbyname($host));
+} catch(Error $e) {
+	print $e->getMessage()."\n";
+}
+try {
+var_dump(gethostbynamel($host));
+} catch(Error $e) {
+	print $e->getMessage()."\n";
+}
+?>
+--EXPECT--
+gethostbyname(): Argument #1 ($hostname) must not contain any null bytes
+gethostbynamel(): Argument #1 ($hostname) must not contain any null bytes