|
 |
f51295 |
From 7cf491b661ee57a11b79f99416c6296bae2f27a0 Mon Sep 17 00:00:00 2001
|
|
|
f51295 |
From: Stanislav Malyshev <stas@php.net>
|
|
|
f51295 |
Date: Tue, 20 Feb 2018 15:34:43 -0800
|
|
|
f51295 |
Subject: [PATCH] Fix bug #75981: prevent reading beyond buffer start
|
|
|
f51295 |
|
|
|
f51295 |
---
|
|
|
f51295 |
ext/standard/http_fopen_wrapper.c | 4 ++--
|
|
|
f51295 |
ext/standard/tests/http/bug75981.phpt | 32 ++++++++++++++++++++++++++++++++
|
|
|
f51295 |
2 files changed, 34 insertions(+), 2 deletions(-)
|
|
|
f51295 |
create mode 100644 ext/standard/tests/http/bug75981.phpt
|
|
|
f51295 |
|
|
|
f51295 |
diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
|
|
|
f51295 |
index f6b0368..75d21c0 100644
|
|
|
f51295 |
--- a/ext/standard/http_fopen_wrapper.c
|
|
|
f51295 |
+++ b/ext/standard/http_fopen_wrapper.c
|
|
|
f51295 |
@@ -691,9 +691,9 @@ finish:
|
|
|
f51295 |
tmp_line, response_code);
|
|
|
f51295 |
}
|
|
|
f51295 |
}
|
|
|
f51295 |
- if (tmp_line[tmp_line_len - 1] == '\n') {
|
|
|
f51295 |
+ if (tmp_line_len >= 1 && tmp_line[tmp_line_len - 1] == '\n') {
|
|
|
f51295 |
--tmp_line_len;
|
|
|
f51295 |
- if (tmp_line[tmp_line_len - 1] == '\r') {
|
|
|
f51295 |
+ if (tmp_line_len >= 1 &&tmp_line[tmp_line_len - 1] == '\r') {
|
|
|
f51295 |
--tmp_line_len;
|
|
|
f51295 |
}
|
|
|
f51295 |
}
|
|
|
f51295 |
diff --git a/ext/standard/tests/http/bug75981.phpt b/ext/standard/tests/http/bug75981.phpt
|
|
|
f51295 |
new file mode 100644
|
|
|
f51295 |
index 0000000..d415de6
|
|
|
f51295 |
--- /dev/null
|
|
|
f51295 |
+++ b/ext/standard/tests/http/bug75981.phpt
|
|
|
f51295 |
@@ -0,0 +1,32 @@
|
|
|
f51295 |
+--TEST--
|
|
|
f51295 |
+Bug #75981 (stack-buffer-overflow while parsing HTTP response)
|
|
|
f51295 |
+--INI--
|
|
|
f51295 |
+allow_url_fopen=1
|
|
|
f51295 |
+--SKIPIF--
|
|
|
f51295 |
+
|
|
|
f51295 |
+--FILE--
|
|
|
f51295 |
+
|
|
|
f51295 |
+require 'server.inc';
|
|
|
f51295 |
+
|
|
|
f51295 |
+$options = [
|
|
|
f51295 |
+ 'http' => [
|
|
|
f51295 |
+ 'protocol_version' => '1.1',
|
|
|
f51295 |
+ 'header' => 'Connection: Close'
|
|
|
f51295 |
+ ],
|
|
|
f51295 |
+];
|
|
|
f51295 |
+
|
|
|
f51295 |
+$ctx = stream_context_create($options);
|
|
|
f51295 |
+
|
|
|
f51295 |
+$responses = [
|
|
|
f51295 |
+ "data://text/plain,000000000100\xA\xA"
|
|
|
f51295 |
+];
|
|
|
f51295 |
+$pid = http_server('tcp://127.0.0.1:12342', $responses);
|
|
|
f51295 |
+
|
|
|
f51295 |
+echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx);
|
|
|
f51295 |
+
|
|
|
f51295 |
+http_server_kill($pid);
|
|
|
f51295 |
+
|
|
|
f51295 |
+?>
|
|
|
f51295 |
+DONE
|
|
|
f51295 |
+--EXPECT--
|
|
|
f51295 |
+DONE
|
|
|
f51295 |
--
|
|
|
f51295 |
2.1.4
|
|
|
f51295 |
|