mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 01:44:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix GHSA-g665-fm4p-vhff: OOB access in ldap_escape

Browse Source
This commit is contained in:
Niels Dossche 2024-09-26 22:22:27 +02:00 committed by Jakub Zelenka
parent d7fe40868e
commit fba659abb9
No known key found for this signature in database
GPG Key ID: 1C0779DC5C0A9DE4
3 changed files with 75 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
ext/ldap/ldap.c
View File

@ -3701,13 +3701,23 @@ static zend_string* php_ldap_do_escape(const bool *map, const char *value, size_
zend_string *ret;
for (i = 0; i < valuelen; i++) {
len += (map[(unsigned char) value[i]]) ? 3 : 1;
size_t addend = (map[(unsigned char) value[i]]) ? 3 : 1;
if (len > ZSTR_MAX_LEN - addend) {
return NULL;
}
len += addend;
}
/* Per RFC 4514, a leading and trailing space must be escaped */
if ((flags & PHP_LDAP_ESCAPE_DN) && (value[0] == ' ')) {
if (len > ZSTR_MAX_LEN - 2) {
return NULL;
}
len += 2;
}
if ((flags & PHP_LDAP_ESCAPE_DN) && ((valuelen > 1) && (value[valuelen - 1] == ' '))) {
if (len > ZSTR_MAX_LEN - 2) {
return NULL;
}
len += 2;
}
@ -3774,7 +3784,13 @@ PHP_FUNCTION(ldap_escape)
php_ldap_escape_map_set_chars(map, ignores, ignoreslen, 0);
}
RETURN_NEW_STR(php_ldap_do_escape(map, value, valuelen, flags));
zend_string *result = php_ldap_do_escape(map, value, valuelen, flags);
if (UNEXPECTED(!result)) {
zend_argument_value_error(1, "is too long");
RETURN_THROWS();
}
RETURN_NEW_STR(result);
}
#ifdef STR_TRANSLATION

28
ext/ldap/tests/GHSA-g665-fm4p-vhff-1.phpt Normal file
View File

@ -0,0 +1,28 @@
--TEST--
GHSA-g665-fm4p-vhff (OOB access in ldap_escape)
--EXTENSIONS--
ldap
--INI--
memory_limit=-1
--SKIPIF--
<?php
if (PHP_INT_SIZE !== 4) die("skip only for 32-bit");
if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
?>
--FILE--
<?php
try {
ldap_escape(' '.str_repeat("#", 1431655758), "", LDAP_ESCAPE_DN);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
ldap_escape(str_repeat("#", 1431655758).' ', "", LDAP_ESCAPE_DN);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
ldap_escape(): Argument #1 ($value) is too long
ldap_escape(): Argument #1 ($value) is too long

29
ext/ldap/tests/GHSA-g665-fm4p-vhff-2.phpt Normal file
View File

@ -0,0 +1,29 @@
--TEST--
GHSA-g665-fm4p-vhff (OOB access in ldap_escape)
--EXTENSIONS--
ldap
--INI--
memory_limit=-1
--SKIPIF--
<?php
if (PHP_INT_SIZE !== 4) die("skip only for 32-bit");
if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
?>
--FILE--
<?php
try {
ldap_escape(str_repeat("*", 1431655759), "", LDAP_ESCAPE_FILTER);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
// would allocate a string of length 2
try {
ldap_escape(str_repeat("*", 1431655766), "", LDAP_ESCAPE_FILTER);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
ldap_escape(): Argument #1 ($value) is too long
ldap_escape(): Argument #1 ($value) is too long