cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Quick fix for a possible file upload exploit. Patch from PHP CVS. Problem

Browse Source 
noted by Brian Clark <brianj@fusionwerks.com>.
This commit is contained in:
jakob 2000-09-04 06:57:12 +00:00
parent bf0666fb03
commit 221c961022
1 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
www/php4/patches/patch-rfc1867.c Normal file
View File

@ -0,0 +1,51 @@
--- main/rfc1867.c:1.38 Sat Aug 5 23:40:28 2000
+++ main/rfc1867.c Sun Sep 3 22:09:46 2000
@@ -15,7 +15,7 @@
| Authors: Rasmus Lerdorf &lt;rasmus@php.net&gt; |
+----------------------------------------------------------------------+
*/
-/* $Id: patch-rfc1867.c,v 1.1 2000/09/04 06:57:12 jakob Exp $ */
+/* $Id: patch-rfc1867.c,v 1.1 2000/09/04 06:57:12 jakob Exp $ */
#include &lt;stdio.h&gt;
#include "php.h"
@@ -64,7 +64,7 @@
int eolsize;
long bytes, max_file_size = 0;
char *namebuf=NULL, *filenamebuf=NULL, *lbuf=NULL,
- *abuf=NULL, *start_arr=NULL, *end_arr=NULL, *arr_index=NULL;
+ *abuf=NULL, *start_arr=NULL, *end_arr=NULL, *arr_index=NULL, *sbuf=NULL;
FILE *fp;
int itype, is_arr_upload=0, arr_len=0;
zval *http_post_files=NULL;
@@ -172,8 +172,10 @@
}
abuf = estrndup(namebuf, strlen(namebuf)-arr_len);
sprintf(lbuf, "%s_name[%s]", abuf, arr_index);
+ sbuf = estrdup(abuf);
} else {
sprintf(lbuf, "%s_name", namebuf);
+ sbuf = estrdup(abuf);
}
s = strrchr(filenamebuf, '\\');
if (s &amp;&amp; s &gt; filenamebuf) {
@@ -252,7 +254,11 @@
}
*(loc - 4) = '\0';
- php_register_variable(namebuf, ptr, array_ptr ELS_CC PLS_CC);
+ /* Check to make sure we are not overwriting special file
+ * upload variables */
+ if(memcmp(namebuf,sbuf,strlen(sbuf))) {
+ php_register_variable(namebuf, ptr, array_ptr ELS_CC PLS_CC);
+ }
/* And a little kludge to pick out special MAX_FILE_SIZE */
itype = php_check_ident_type(namebuf);
@@ -353,6 +359,7 @@
break;
}
}
+ if(sbuf) efree(sbuf);
SAFE_RETURN;
}