Skip to content

Commit

Permalink
Fix #78863: DirectoryIterator class silently truncates after a null byte
Browse files Browse the repository at this point in the history
Since the constructor of DirectoryIterator and friends is supposed to
accepts paths (i.e. strings without NUL bytes), we must not accept
arbitrary strings.

(cherry picked from commit a5a1596)
  • Loading branch information
cmb69 authored and remicollet committed Dec 17, 2019
1 parent 315eae9 commit d74907b
Show file tree
Hide file tree
Showing 2 changed files with 33 additions and 2 deletions.
4 changes: 2 additions & 2 deletions ext/spl/spl_directory.c
Original file line number Diff line number Diff line change
Expand Up @@ -708,10 +708,10 @@ void spl_filesystem_object_construct(INTERNAL_FUNCTION_PARAMETERS, zend_long cto

if (SPL_HAS_FLAG(ctor_flags, DIT_CTOR_FLAGS)) {
flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_FILEINFO;
parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &path, &len, &flags);
parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &path, &len, &flags);
} else {
flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_SELF;
parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s", &path, &len);
parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p", &path, &len);
}
if (SPL_HAS_FLAG(ctor_flags, SPL_FILE_DIR_SKIPDOTS)) {
flags |= SPL_FILE_DIR_SKIPDOTS;
Expand Down
31 changes: 31 additions & 0 deletions ext/spl/tests/bug78863.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
--TEST--
Bug #78863 (DirectoryIterator class silently truncates after a null byte)
--FILE--
<?php
$dir = __DIR__ . '/bug78863';
mkdir($dir);
touch("$dir/bad");
mkdir("$dir/sub");
touch("$dir/sub/good");

$it = new DirectoryIterator(__DIR__ . "/bug78863\0/sub");
foreach ($it as $fileinfo) {
if (!$fileinfo->isDot()) {
var_dump($fileinfo->getFilename());
}
}
?>
--EXPECTF--
Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d
Stack trace:
#0 %s(%d): DirectoryIterator->__construct('%s')
#1 {main}
thrown in %s on line %d
--CLEAN--
<?php
$dir = __DIR__ . '/bug78863';
unlink("$dir/sub/good");
rmdir("$dir/sub");
unlink("$dir/bad");
rmdir($dir);
?>

0 comments on commit d74907b

Please sign in to comment.