Skip to content

Commit 6d99ccc

Browse files
ramseyramsey
committed
Merge branch 'PHP-8.2' into PHP-8.3
2 parents bf8c01d + c259c9f commit 6d99ccc

8 files changed

+243
-32
lines changed

‎NEWS

+16-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,14 @@ PHP NEWS
4545
- Windows:
4646
. Fixed minimal Windows version. (cmb)
4747

48-
12 Sep 2024, PHP 8.3.12
48+
26 Sep 2024, PHP 8.3.12
49+
50+
- CGI:
51+
. Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection
52+
Vulnerability). (CVE-2024-8926) (nielsdos)
53+
. Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is
54+
bypassable due to the environment variable collision). (CVE-2024-8927)
55+
(nielsdos)
4956

5057
- Core:
5158
. Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
@@ -73,6 +80,10 @@ PHP NEWS
7380
. Fixed bug GH-15752 (Incorrect error message for finfo_file
7481
with an empty filename argument). (DanielEScherzer)
7582

83+
- FPM:
84+
. Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered).
85+
(CVE-2024-9026) (Jakub Zelenka)
86+
7687
- MySQLnd:
7788
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
7889
Kamil Tekiela)
@@ -83,6 +94,10 @@ PHP NEWS
8394
. Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
8495
(nielsdos)
8596

97+
- SAPI:
98+
. Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).
99+
(CVE-2024-8925) (Arnaud)
100+
86101
- Standard:
87102
. Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb)
88103

‎main/rfc1867.c

+7
Original file line numberDiff line numberDiff line change
@@ -729,6 +729,13 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
729729
boundary_len = boundary_end-boundary;
730730
}
731731

732+
/* Boundaries larger than FILLUNIT-strlen("\r\n--") characters lead to
733+
* erroneous parsing */
734+
if (boundary_len > FILLUNIT-strlen("\r\n--")) {
735+
sapi_module.sapi_error(E_WARNING, "Boundary too large in multipart/form-data POST data");
736+
return;
737+
}
738+
732739
/* Initialize the buffer */
733740
if (!(mbuff = multipart_buffer_new(boundary, boundary_len))) {
734741
sapi_module.sapi_error(E_WARNING, "Unable to initialize the input buffer");

‎sapi/cgi/cgi_main.c

+19-30
Original file line numberDiff line numberDiff line change
@@ -1746,7 +1746,6 @@ int main(int argc, char *argv[])
17461746
int status = 0;
17471747
#endif
17481748
char *query_string;
1749-
char *decoded_query_string;
17501749
int skip_getopt = 0;
17511750

17521751
#if defined(SIGPIPE) && defined(SIG_IGN)
@@ -1801,10 +1800,15 @@ int main(int argc, char *argv[])
18011800
* the executable. Ideally we skip argument parsing when we're in cgi or fastcgi mode,
18021801
* but that breaks PHP scripts on Linux with a hashbang: `#!/php-cgi -d option=value`.
18031802
* Therefore, this code only prevents passing arguments if the query string starts with a '-'.
1804-
* Similarly, scripts spawned in subprocesses on Windows may have the same issue. */
1803+
* Similarly, scripts spawned in subprocesses on Windows may have the same issue.
1804+
* However, Windows has lots of conversion rules and command line parsing rules that
1805+
* are too difficult and dangerous to reliably emulate. */
18051806
if((query_string = getenv("QUERY_STRING")) != NULL && strchr(query_string, '=') == NULL) {
1807+
#ifdef PHP_WIN32
1808+
skip_getopt = cgi || fastcgi;
1809+
#else
18061810
unsigned char *p;
1807-
decoded_query_string = strdup(query_string);
1811+
char *decoded_query_string = strdup(query_string);
18081812
php_url_decode(decoded_query_string, strlen(decoded_query_string));
18091813
for (p = (unsigned char *)decoded_query_string; *p && *p <= ' '; p++) {
18101814
/* skip all leading spaces */
@@ -1813,22 +1817,8 @@ int main(int argc, char *argv[])
18131817
skip_getopt = 1;
18141818
}
18151819

1816-
/* On Windows we have to take into account the "best fit" mapping behaviour. */
1817-
#ifdef PHP_WIN32
1818-
if (*p >= 0x80) {
1819-
wchar_t wide_buf[1];
1820-
wide_buf[0] = *p;
1821-
char char_buf[4];
1822-
size_t wide_buf_len = sizeof(wide_buf) / sizeof(wide_buf[0]);
1823-
size_t char_buf_len = sizeof(char_buf) / sizeof(char_buf[0]);
1824-
if (WideCharToMultiByte(CP_ACP, 0, wide_buf, wide_buf_len, char_buf, char_buf_len, NULL, NULL) == 0
1825-
|| char_buf[0] == '-') {
1826-
skip_getopt = 1;
1827-
}
1828-
}
1829-
#endif
1830-
18311820
free(decoded_query_string);
1821+
#endif
18321822
}
18331823

18341824
php_ini_builder_init(&ini_builder);
@@ -1895,18 +1885,17 @@ int main(int argc, char *argv[])
18951885

18961886
/* check force_cgi after startup, so we have proper output */
18971887
if (cgi && CGIG(force_redirect)) {
1898-
/* Apache will generate REDIRECT_STATUS,
1899-
* Netscape and redirect.so will generate HTTP_REDIRECT_STATUS.
1900-
* redirect.so and installation instructions available from
1901-
* http://www.koehntopp.de/php.
1902-
* -- kk@netuse.de
1903-
*/
1904-
if (!getenv("REDIRECT_STATUS") &&
1905-
!getenv ("HTTP_REDIRECT_STATUS") &&
1906-
/* this is to allow a different env var to be configured
1907-
* in case some server does something different than above */
1908-
(!CGIG(redirect_status_env) || !getenv(CGIG(redirect_status_env)))
1909-
) {
1888+
/* This is to allow a different environment variable to be configured
1889+
* in case the we cannot auto-detect which environment variable to use.
1890+
* Checking this first to allow user overrides in case the environment
1891+
* variable can be set by an untrusted party. */
1892+
const char *redirect_status_env = CGIG(redirect_status_env);
1893+
if (!redirect_status_env) {
1894+
/* Apache will generate REDIRECT_STATUS. */
1895+
redirect_status_env = "REDIRECT_STATUS";
1896+
}
1897+
1898+
if (!getenv(redirect_status_env)) {
19101899
zend_try {
19111900
SG(sapi_headers).http_response_code = 400;
19121901
PUTS("<b>Security Alert!</b> The PHP CGI cannot be accessed directly.\n\n\

‎sapi/fpm/fpm/fpm_stdio.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ static void fpm_stdio_child_said(struct fpm_event_s *ev, short which, void *arg)
228228
if ((sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos) <= in_buf &&
229229
!memcmp(buf, &FPM_STDIO_CMD_FLUSH[cmd_pos], sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos)) {
230230
zlog_stream_finish(log_stream);
231-
start = cmd_pos;
231+
start = sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos;
232232
} else {
233233
zlog_stream_str(log_stream, &FPM_STDIO_CMD_FLUSH[0], cmd_pos);
234234
}

‎sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-end.phpt

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
--TEST--
2+
FPM: Buffered worker output plain log with msg with flush split position towards separator end
3+
--SKIPIF--
4+
<?php include "skipif.inc"; ?>
5+
--FILE--
6+
<?php
7+
8+
require_once "tester.inc";
9+
10+
$cfg = <<<EOT
11+
[global]
12+
error_log = {{FILE:LOG}}
13+
[unconfined]
14+
listen = {{ADDR}}
15+
pm = dynamic
16+
pm.max_children = 5
17+
pm.start_servers = 1
18+
pm.min_spare_servers = 1
19+
pm.max_spare_servers = 3
20+
catch_workers_output = yes
21+
decorate_workers_output = no
22+
EOT;
23+
24+
$code = <<<EOT
25+
<?php
26+
file_put_contents('php://stderr', str_repeat('a', 1013) . "Quarkslab\0fscf\0Quarkslab");
27+
EOT;
28+
29+
$tester = new FPM\Tester($cfg, $code);
30+
$tester->start();
31+
$tester->expectLogStartNotices();
32+
$tester->request()->expectEmptyBody();
33+
$tester->expectLogLine(str_repeat('a', 1013) . "Quarkslab", decorated: false);
34+
$tester->expectLogLine("Quarkslab", decorated: false);
35+
$tester->terminate();
36+
$tester->expectLogTerminatingNotices();
37+
$tester->close();
38+
39+
?>
40+
Done
41+
--EXPECT--
42+
Done
43+
--CLEAN--
44+
<?php
45+
require_once "tester.inc";
46+
FPM\Tester::clean();
47+
?>

‎sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-start.phpt

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
--TEST--
2+
FPM: Buffered worker output plain log with msg with flush split position towards separator start
3+
--SKIPIF--
4+
<?php include "skipif.inc"; ?>
5+
--FILE--
6+
<?php
7+
8+
require_once "tester.inc";
9+
10+
$cfg = <<<EOT
11+
[global]
12+
error_log = {{FILE:LOG}}
13+
[unconfined]
14+
listen = {{ADDR}}
15+
pm = dynamic
16+
pm.max_children = 5
17+
pm.start_servers = 1
18+
pm.min_spare_servers = 1
19+
pm.max_spare_servers = 3
20+
catch_workers_output = yes
21+
decorate_workers_output = no
22+
EOT;
23+
24+
$code = <<<EOT
25+
<?php
26+
file_put_contents('php://stderr', str_repeat('a', 1009) . "Quarkslab\0fscf\0Quarkslab");
27+
EOT;
28+
29+
$tester = new FPM\Tester($cfg, $code);
30+
$tester->start();
31+
$tester->expectLogStartNotices();
32+
$tester->request()->expectEmptyBody();
33+
$tester->expectLogLine(str_repeat('a', 1009) . "Quarkslab", decorated: false);
34+
$tester->expectLogLine("Quarkslab", decorated: false);
35+
$tester->terminate();
36+
$tester->expectLogTerminatingNotices();
37+
$tester->close();
38+
39+
?>
40+
Done
41+
--EXPECT--
42+
Done
43+
--CLEAN--
44+
<?php
45+
require_once "tester.inc";
46+
FPM\Tester::clean();
47+
?>

‎tests/basic/GHSA-9pqp-7h25-4f32.inc

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?php
2+
print "Hello world\n";
3+
var_dump($_POST);

‎tests/basic/GHSA-9pqp-7h25-4f32.phpt

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
--TEST--
2+
GHSA-9pqp-7h25-4f32
3+
--SKIPIF--
4+
<?php
5+
if (!getenv('TEST_PHP_CGI_EXECUTABLE')) {
6+
die("skip php-cgi not available");
7+
}
8+
if (substr(PHP_OS, 0, 3) == 'WIN') {
9+
die("skip not for Windows in CI - probably resource issue");
10+
}
11+
?>
12+
--FILE--
13+
<?php
14+
15+
const FILLUNIT = 5 * 1024;
16+
17+
function test($boundaryLen) {
18+
printf("Boundary len: %d\n", $boundaryLen);
19+
20+
$cmd = [
21+
getenv('TEST_PHP_CGI_EXECUTABLE'),
22+
'-C',
23+
'-n',
24+
__DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
25+
];
26+
27+
$boundary = str_repeat('A', $boundaryLen);
28+
$body = ""
29+
. "--$boundary\r\n"
30+
. "Content-Disposition: form-data; name=\"koko\"\r\n"
31+
. "\r\n"
32+
. "BBB\r\n--" . substr($boundary, 0, -1) . "CCC\r\n"
33+
. "--$boundary--\r\n"
34+
;
35+
36+
$env = array_merge($_ENV, [
37+
'REDIRECT_STATUS' => '1',
38+
'CONTENT_TYPE' => "multipart/form-data; boundary=$boundary",
39+
'CONTENT_LENGTH' => strlen($body),
40+
'REQUEST_METHOD' => 'POST',
41+
'SCRIPT_FILENAME' => __DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
42+
]);
43+
44+
$spec = [
45+
0 => ['pipe', 'r'],
46+
1 => STDOUT,
47+
2 => STDOUT,
48+
];
49+
50+
$pipes = [];
51+
52+
print "Starting...\n";
53+
54+
$handle = proc_open($cmd, $spec, $pipes, getcwd(), $env);
55+
56+
fwrite($pipes[0], $body);
57+
58+
$status = proc_close($handle);
59+
60+
print "\n";
61+
}
62+
63+
for ($offset = -1; $offset <= 1; $offset++) {
64+
test(FILLUNIT - strlen("\r\n--") + $offset);
65+
}
66+
67+
?>
68+
--EXPECTF--
69+
Boundary len: 5115
70+
Starting...
71+
X-Powered-By: %s
72+
Content-type: text/html; charset=UTF-8
73+
74+
Hello world
75+
array(1) {
76+
["koko"]=>
77+
string(5124) "BBB
78+
--AAA%sCCC"
79+
}
80+
81+
Boundary len: 5116
82+
Starting...
83+
X-Powered-By: %s
84+
Content-type: text/html; charset=UTF-8
85+
86+
Hello world
87+
array(1) {
88+
["koko"]=>
89+
string(5125) "BBB
90+
--AAA%sCCC"
91+
}
92+
93+
Boundary len: 5117
94+
Starting...
95+
X-Powered-By: %s
96+
Content-type: text/html; charset=UTF-8
97+
98+
<br />
99+
<b>Warning</b>: Boundary too large in multipart/form-data POST data in <b>Unknown</b> on line <b>0</b><br />
100+
Hello world
101+
array(0) {
102+
}
103+

0 commit comments

Comments
 (0)