mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-27 11:53:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #69511 Off-by-one bufferoverflow in php_sys_readlink

Browse Source
This commit is contained in:
Anatol Belski 2015-05-19 15:44:55 +02:00
parent eebab8282b
commit 890a28d4b9
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -78,6 +78,8 @@
. Implemented the RFC `Fix "foreach" behavior`. (Dmitry) . Implemented the RFC `Fix "foreach" behavior`. (Dmitry)
. Implemented the RFC `Generator Delegation`. (Bob) . Implemented the RFC `Generator Delegation`. (Bob)
. Implemented the RFC ` Anonymous Class Support`. (Joe, Nikita, Dmitry) . Implemented the RFC ` Anonymous Class Support`. (Joe, Nikita, Dmitry)
. Fixed bug #69511 (Off-by-one buffer overflow in php_sys_readlink).
(Jan Starke, Anatol)
- Curl: - Curl:
. Fixed bug #68937 (Segfault in curl_multi_exec). (Laruence) . Fixed bug #68937 (Segfault in curl_multi_exec). (Laruence)

14
Zend/zend_virtual_cwd.c
View File

@ -237,6 +237,10 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){
typedef BOOL (WINAPI *gfpnh_func)(HANDLE, LPTSTR, DWORD, DWORD); typedef BOOL (WINAPI *gfpnh_func)(HANDLE, LPTSTR, DWORD, DWORD);
gfpnh_func pGetFinalPathNameByHandle; gfpnh_func pGetFinalPathNameByHandle;
if (!target_len) {
return -1;
}
kernel32 = LoadLibrary("kernel32.dll"); kernel32 = LoadLibrary("kernel32.dll");
if (kernel32) { if (kernel32) {
@ -260,8 +264,14 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){
return -1; return -1;
} }
dwRet = pGetFinalPathNameByHandle(hFile, target, MAXPATHLEN, VOLUME_NAME_DOS); /* Despite MSDN has documented it won't to, the length returned by
if(dwRet >= MAXPATHLEN || dwRet == 0) { GetFinalPathNameByHandleA includes the length of the
null terminator. This behavior is at least reproducible
with VS2012 and earlier, and seems not to be fixed till
now. Thus, correcting target_len so it's suddenly don't
overflown. */
dwRet = pGetFinalPathNameByHandle(hFile, target, target_len - 1, VOLUME_NAME_DOS);
if(dwRet >= target_len || dwRet >= MAXPATHLEN || dwRet == 0) {
return -1; return -1;
} }