Skip to content

Commit ed70b1e

Browse files
ndosschebukka
authored andcommitted
Fix GHSA-www2-q4fc-65wf
1 parent 8b80115 commit ed70b1e

File tree

4 files changed

+74
-12
lines changed

4 files changed

+74
-12
lines changed

ext/standard/basic_functions.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -638,7 +638,7 @@ PHP_FUNCTION(inet_pton)
638638
char buffer[17];
639639

640640
ZEND_PARSE_PARAMETERS_START(1, 1)
641-
Z_PARAM_STRING(address, address_len)
641+
Z_PARAM_PATH(address, address_len)
642642
ZEND_PARSE_PARAMETERS_END();
643643

644644
memset(buffer, 0, sizeof(buffer));
@@ -675,7 +675,7 @@ PHP_FUNCTION(ip2long)
675675
#endif
676676

677677
ZEND_PARSE_PARAMETERS_START(1, 1)
678-
Z_PARAM_STRING(addr, addr_len)
678+
Z_PARAM_PATH(addr, addr_len)
679679
ZEND_PARSE_PARAMETERS_END();
680680

681681
#ifdef HAVE_INET_PTON
@@ -2249,8 +2249,8 @@ PHP_FUNCTION(getservbyname)
22492249
struct servent *serv;
22502250

22512251
ZEND_PARSE_PARAMETERS_START(2, 2)
2252-
Z_PARAM_STR(name)
2253-
Z_PARAM_STRING(proto, proto_len)
2252+
Z_PARAM_PATH_STR(name)
2253+
Z_PARAM_PATH(proto, proto_len)
22542254
ZEND_PARSE_PARAMETERS_END();
22552255

22562256

@@ -2293,7 +2293,7 @@ PHP_FUNCTION(getservbyport)
22932293

22942294
ZEND_PARSE_PARAMETERS_START(2, 2)
22952295
Z_PARAM_LONG(port)
2296-
Z_PARAM_STRING(proto, proto_len)
2296+
Z_PARAM_PATH(proto, proto_len)
22972297
ZEND_PARSE_PARAMETERS_END();
22982298

22992299
serv = getservbyport(htons((unsigned short) port), proto);
@@ -2316,7 +2316,7 @@ PHP_FUNCTION(getprotobyname)
23162316
struct protoent *ent;
23172317

23182318
ZEND_PARSE_PARAMETERS_START(1, 1)
2319-
Z_PARAM_STRING(name, name_len)
2319+
Z_PARAM_PATH(name, name_len)
23202320
ZEND_PARSE_PARAMETERS_END();
23212321

23222322
ent = getprotobyname(name);

ext/standard/dns.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -399,7 +399,7 @@ PHP_FUNCTION(dns_check_record)
399399
#endif
400400

401401
ZEND_PARSE_PARAMETERS_START(1, 2)
402-
Z_PARAM_STRING(hostname, hostname_len)
402+
Z_PARAM_PATH(hostname, hostname_len)
403403
Z_PARAM_OPTIONAL
404404
Z_PARAM_STR(rectype)
405405
ZEND_PARSE_PARAMETERS_END();
@@ -846,7 +846,7 @@ PHP_FUNCTION(dns_get_record)
846846
bool raw = 0;
847847

848848
ZEND_PARSE_PARAMETERS_START(1, 5)
849-
Z_PARAM_STRING(hostname, hostname_len)
849+
Z_PARAM_PATH(hostname, hostname_len)
850850
Z_PARAM_OPTIONAL
851851
Z_PARAM_LONG(type_param)
852852
Z_PARAM_ZVAL(authns)
@@ -1084,7 +1084,7 @@ PHP_FUNCTION(dns_get_mx)
10841084
#endif
10851085

10861086
ZEND_PARSE_PARAMETERS_START(2, 3)
1087-
Z_PARAM_STRING(hostname, hostname_len)
1087+
Z_PARAM_PATH(hostname, hostname_len)
10881088
Z_PARAM_ZVAL(mx_list)
10891089
Z_PARAM_OPTIONAL
10901090
Z_PARAM_ZVAL(weight_list)

ext/standard/dns_win32.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ PHP_FUNCTION(dns_get_mx) /* {{{ */
4848
DNS_STATUS status; /* Return value of DnsQuery_A() function */
4949
PDNS_RECORD pResult, pRec; /* Pointer to DNS_RECORD structure */
5050

51-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "sz|z", &hostname, &hostname_len, &mx_list, &weight_list) == FAILURE) {
51+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "pz|z", &hostname, &hostname_len, &mx_list, &weight_list) == FAILURE) {
5252
RETURN_THROWS();
5353
}
5454

@@ -102,7 +102,7 @@ PHP_FUNCTION(dns_check_record)
102102
DNS_STATUS status; /* Return value of DnsQuery_A() function */
103103
PDNS_RECORD pResult; /* Pointer to DNS_RECORD structure */
104104

105-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|S", &hostname, &hostname_len, &rectype) == FAILURE) {
105+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "p|S", &hostname, &hostname_len, &rectype) == FAILURE) {
106106
RETURN_THROWS();
107107
}
108108

@@ -354,7 +354,7 @@ PHP_FUNCTION(dns_get_record)
354354
int type, type_to_fetch, first_query = 1, store_results = 1;
355355
bool raw = 0;
356356

357-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|lz!z!b",
357+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "p|lz!z!b",
358358
&hostname, &hostname_len, &type_param, &authns, &addtl, &raw) == FAILURE) {
359359
RETURN_THROWS();
360360
}
Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
--TEST--
2+
GHSA-www2-q4fc-65wf
3+
--DESCRIPTION--
4+
This is a ZPP test but *keep* this as it is security-sensitive!
5+
--FILE--
6+
<?php
7+
try {
8+
dns_check_record("\0");
9+
} catch (ValueError $e) {
10+
echo $e->getMessage(), "\n";
11+
}
12+
try {
13+
dns_get_mx("\0", $out);
14+
} catch (ValueError $e) {
15+
echo $e->getMessage(), "\n";
16+
}
17+
try {
18+
dns_get_record("\0");
19+
} catch (ValueError $e) {
20+
echo $e->getMessage(), "\n";
21+
}
22+
try {
23+
getprotobyname("\0");
24+
} catch (ValueError $e) {
25+
echo $e->getMessage(), "\n";
26+
}
27+
try {
28+
getservbyname("\0", "tcp");
29+
} catch (ValueError $e) {
30+
echo $e->getMessage(), "\n";
31+
}
32+
try {
33+
getservbyname("x", "tcp\0");
34+
} catch (ValueError $e) {
35+
echo $e->getMessage(), "\n";
36+
}
37+
try {
38+
getservbyport(0, "tcp\0");
39+
} catch (ValueError $e) {
40+
echo $e->getMessage(), "\n";
41+
}
42+
try {
43+
inet_pton("\0");
44+
} catch (ValueError $e) {
45+
echo $e->getMessage(), "\n";
46+
}
47+
try {
48+
ip2long("\0");
49+
} catch (ValueError $e) {
50+
echo $e->getMessage(), "\n";
51+
}
52+
?>
53+
--EXPECT--
54+
dns_check_record(): Argument #1 ($hostname) must not contain any null bytes
55+
dns_get_mx(): Argument #1 ($hostname) must not contain any null bytes
56+
dns_get_record(): Argument #1 ($hostname) must not contain any null bytes
57+
getprotobyname(): Argument #1 ($protocol) must not contain any null bytes
58+
getservbyname(): Argument #1 ($service) must not contain any null bytes
59+
getservbyname(): Argument #2 ($protocol) must not contain any null bytes
60+
getservbyport(): Argument #2 ($protocol) must not contain any null bytes
61+
inet_pton(): Argument #1 ($ip) must not contain any null bytes
62+
ip2long(): Argument #1 ($ip) must not contain any null bytes

0 commit comments

Comments
 (0)