92 lines
4.3 KiB
Plaintext
92 lines
4.3 KiB
Plaintext
$OpenBSD: patch-stream_c,v 1.1 2010/12/27 20:34:30 jasper Exp $
|
|
|
|
Security fix for SA42726
|
|
PECL phar Extension Format String Vulnerabilities.
|
|
|
|
Patch from upstream svn:
|
|
http://svn.php.net/viewvc?view=revision&revision=306667
|
|
|
|
--- stream.c.orig Thu Jan 1 10:13:08 1970
|
|
+++ stream.c Mon Dec 27 21:30:56 2010
|
|
@@ -117,7 +117,7 @@ php_url* phar_parse_url(php_stream_wrapper *wrapper, c
|
|
{
|
|
if (error) {
|
|
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
|
|
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
|
|
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
|
|
}
|
|
efree(error);
|
|
}
|
|
@@ -128,7 +128,7 @@ php_url* phar_parse_url(php_stream_wrapper *wrapper, c
|
|
if (error) {
|
|
spprintf(&error, 0, "Cannot open cached phar '%s' as writeable, copy on write failed", resource->host);
|
|
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
|
|
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
|
|
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
|
|
}
|
|
efree(error);
|
|
}
|
|
@@ -140,7 +140,7 @@ php_url* phar_parse_url(php_stream_wrapper *wrapper, c
|
|
{
|
|
if (error) {
|
|
if (!(options & PHP_STREAM_URL_STAT_QUIET)) {
|
|
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
|
|
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
|
|
}
|
|
efree(error);
|
|
}
|
|
@@ -192,7 +192,7 @@ static php_stream * phar_wrapper_open_url(php_stream_w
|
|
if (mode[0] == 'w' || (mode[0] == 'r' && mode[1] == '+')) {
|
|
if (NULL == (idata = phar_get_or_create_entry_data(resource->host, host_len, internal_file, strlen(internal_file), mode, 0, &error, 1 TSRMLS_CC))) {
|
|
if (error) {
|
|
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
|
|
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
|
|
efree(error);
|
|
} else {
|
|
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "phar error: file \"%s\" could not be created in phar \"%s\"", internal_file, resource->host);
|
|
@@ -250,7 +250,7 @@ static php_stream * phar_wrapper_open_url(php_stream_w
|
|
if (!*internal_file && (options & STREAM_OPEN_FOR_INCLUDE)) {
|
|
/* retrieve the stub */
|
|
if (FAILURE == phar_get_archive(&phar, resource->host, host_len, NULL, 0, NULL TSRMLS_CC)) {
|
|
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "file %s is not a valid phar archive");
|
|
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "file %s is not a valid phar archive", resource->host);
|
|
efree(internal_file);
|
|
php_url_free(resource);
|
|
return NULL;
|
|
@@ -297,7 +297,7 @@ static php_stream * phar_wrapper_open_url(php_stream_w
|
|
if ((FAILURE == phar_get_entry_data(&idata, resource->host, host_len, internal_file, strlen(internal_file), "r", 0, &error, 0 TSRMLS_CC)) || !idata) {
|
|
idata_error:
|
|
if (error) {
|
|
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
|
|
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
|
|
efree(error);
|
|
} else {
|
|
php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "phar error: \"%s\" is not a file in phar \"%s\"", internal_file, resource->host);
|
|
@@ -320,7 +320,7 @@ idata_error:
|
|
|
|
/* check length, crc32 */
|
|
if (!idata->internal_file->is_crc_checked && phar_postprocess_file(idata, idata->internal_file->crc32, &error, 2 TSRMLS_CC) != SUCCESS) {
|
|
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
|
|
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
|
|
efree(error);
|
|
phar_entry_delref(idata TSRMLS_CC);
|
|
efree(internal_file);
|
|
@@ -470,7 +470,7 @@ static int phar_stream_flush(php_stream *stream TSRMLS
|
|
if (stream->mode[0] == 'w' || (stream->mode[0] == 'r' && stream->mode[1] == '+')) {
|
|
ret = phar_flush(((phar_entry_data *)stream->abstract)->phar, 0, 0, 0, &error TSRMLS_CC);
|
|
if (error) {
|
|
- php_stream_wrapper_log_error(stream->wrapper, REPORT_ERRORS TSRMLS_CC, error);
|
|
+ php_stream_wrapper_log_error(stream->wrapper, REPORT_ERRORS TSRMLS_CC, "%s", error);
|
|
efree(error);
|
|
}
|
|
return ret;
|
|
@@ -761,7 +761,7 @@ static int phar_wrapper_unlink(php_stream_wrapper *wra
|
|
efree(internal_file);
|
|
phar_entry_remove(idata, &error TSRMLS_CC);
|
|
if (error) {
|
|
- php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, error);
|
|
+ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", error);
|
|
efree(error);
|
|
}
|
|
return 1;
|