Projects
home:rottame:vhosts-ng:php74
php7
php7-CVE-2026-109618,109619.patch
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File php7-CVE-2026-109618,109619.patch of Package php7
From 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2 Mon Sep 17 00:00:00 2001 From: Arnaud Le Blanc <arnaud.lb@gmail.com> Date: Sun, 18 Oct 2026 20:09:54 +0200 Subject: [PATCH] Avoid state corruption via bailout Minimal mitigation for EOL version. Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> --- Zend/zend_API.h | 1 + Zend/zend_alloc.c | 68 ++++++++++++++++++++--------- Zend/zend_alloc.h | 2 + Zend/zend_execute_API.c | 13 ++++++ Zend/zend_hash.c | 13 ++++-- Zend/zend_hash.h | 1 + Zend/zend_llist.c | 2 + Zend/zend_multiply.h | 4 +- Zend/zend_strtod.c | 4 +- Zend/zend_types.h | 26 +++++++----- Zend/zend_vm_def.h | 11 ++++- Zend/zend_vm_execute.h | 94 +++++++++++++++++++++++++++++++++++++---- ext/session/session.c | 2 +- main/SAPI.c | 5 +++ main/main.c | 6 +++ main/php_variables.c | 8 ++-- main/rfc1867.c | 39 ++++++++++++++--- 17 files changed, 240 insertions(+), 59 deletions(-) Index: php-7.4.33/Zend/zend_API.h =================================================================== --- php-7.4.33.orig/Zend/zend_API.h +++ php-7.4.33/Zend/zend_API.h @@ -380,6 +380,7 @@ ZEND_API char *zend_get_type_by_const(in #define array_init(arg) ZVAL_ARR((arg), zend_new_array(0)) #define array_init_size(arg, size) ZVAL_ARR((arg), zend_new_array(size)) +#define array_init_singleton(arg) ZVAL_ARR((arg), zend_new_array_singleton()) ZEND_API int object_init(zval *arg); ZEND_API int object_init_ex(zval *arg, zend_class_entry *ce); ZEND_API int object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties); Index: php-7.4.33/Zend/zend_alloc.c =================================================================== --- php-7.4.33.orig/Zend/zend_alloc.c +++ php-7.4.33/Zend/zend_alloc.c @@ -57,6 +57,7 @@ #include "zend_operators.h" #include "zend_multiply.h" #include "zend_bitset.h" +#include "zend_execute.h" #include <signal.h> #ifdef HAVE_UNISTD_H @@ -363,7 +364,42 @@ static ZEND_COLD ZEND_NORETURN void zend #if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID) kill(getpid(), SIGSEGV); #endif - exit(1); + _exit(1); +} + +ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...) +{ + zend_string *script_filename = NULL; + uint32_t script_lineno = 0; + + if (zend_is_executing()) { + script_filename = zend_get_executed_filename_ex(); + script_lineno = zend_get_executed_lineno(); + } else if (zend_is_compiling()) { + script_filename = zend_get_compiled_filename(); + script_lineno = zend_get_compiled_lineno(); + } + + va_list args; + va_start(args, format); + + char buf[1024]; + vsnprintf(buf, sizeof(buf), format, args); + + va_end(args); + + fprintf(stderr, + "\nFatal error: %s in %s on line %d\n", + buf, + script_filename ? ZSTR_VAL(script_filename) : "Unknown", + script_lineno); + + /* See http://support.microsoft.com/kb/190351 */ +# ifdef ZEND_WIN32 + fflush(stderr); +# endif + + _exit(1); } static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap, @@ -375,22 +411,14 @@ static ZEND_COLD ZEND_NORETURN void zend #endif size_t size) { + (void) heap; - heap->overflow = 1; - zend_try { - zend_error_noreturn(E_ERROR, - format, - limit, -#if ZEND_DEBUG - filename, - lineno, -#endif - size); - } zend_catch { - } zend_end_try(); - heap->overflow = 0; - zend_bailout(); - exit(1); + zend_mm_safe_error_ex(format, limit, +#if ZEND_DEBUG + filename, + lineno, +#endif + size); } #ifdef _WIN32 @@ -1318,7 +1346,7 @@ static zend_always_inline void *zend_mm_ size = MAX(size, 1); size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)); if (UNEXPECTED(size < real_size)) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info))); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info))); return NULL; } #endif @@ -1762,7 +1790,7 @@ static void *zend_mm_alloc_huge(zend_mm_ void *ptr; if (UNEXPECTED(new_size < size)) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment); } #if ZEND_MM_LIMIT @@ -2617,7 +2645,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(co length = strlen(s); if (UNEXPECTED(length + 1 == 0)) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length); } p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); memcpy(p, s, length+1); @@ -2629,7 +2657,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(c char *p; if (UNEXPECTED(length + 1 == 0)) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length); } p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); memcpy(p, s, length); @@ -2643,7 +2671,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndu char *p; if (UNEXPECTED(length + 1 == 0)) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length); } p = (char *) malloc(length + 1); if (UNEXPECTED(p == NULL)) { @@ -2974,7 +3002,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_e static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void) { fprintf(stderr, "Out of memory\n"); - exit(1); + _exit(1); } ZEND_API void * __zend_malloc(size_t len) Index: php-7.4.33/Zend/zend_alloc.h =================================================================== --- php-7.4.33.orig/Zend/zend_alloc.h +++ php-7.4.33/Zend/zend_alloc.h @@ -402,6 +402,8 @@ static void apc_init_heap(void) size_t zend_mm_globals_size(void); #endif +ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...); + END_EXTERN_C() #endif Index: php-7.4.33/Zend/zend_execute_API.c =================================================================== --- php-7.4.33.orig/Zend/zend_execute_API.c +++ php-7.4.33/Zend/zend_execute_API.c @@ -337,10 +337,21 @@ void shutdown_executor(void) /* {{{ */ gc_collect_cycles(); } #endif + } else { + /* may be used by zend_error_zstr_at before init_executor */ + ZVAL_UNDEF(&EG(user_error_handler)); + ZVAL_UNDEF(&EG(user_exception_handler)); + memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting))); + memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers))); + memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers))); } zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown); + /* may be used by zend_error_zstr_at before init_executor */ + EG(error_handling) = EH_NORMAL; + EG(exception) = NULL; + zend_weakrefs_shutdown(); zend_try { @@ -357,6 +368,8 @@ void shutdown_executor(void) /* {{{ */ zend_hash_discard(EG(function_table), EG(persistent_functions_count)); zend_hash_discard(EG(class_table), EG(persistent_classes_count)); zend_cleanup_internal_classes(); + EG(objects_store).object_buckets = NULL; + EG(objects_store).top = 1; } else { zend_vm_stack_destroy(); Index: php-7.4.33/Zend/zend_hash.c =================================================================== --- php-7.4.33.orig/Zend/zend_hash.c +++ php-7.4.33/Zend/zend_hash.c @@ -97,7 +97,7 @@ static zend_always_inline uint32_t zend_ if (nSize <= HT_MIN_SIZE) { return HT_MIN_SIZE; } else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket)); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket)); } #if defined(ZEND_WIN32) @@ -251,6 +251,13 @@ ZEND_API HashTable* ZEND_FASTCALL _zend_ return ht; } +ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void) +{ + HashTable *ht = _zend_new_array_0(); + ht->nTableSize = 1; + return ht; +} + ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t nSize) { HashTable *ht = emalloc(sizeof(HashTable)); @@ -282,7 +289,7 @@ static void ZEND_FASTCALL zend_hash_pack { HT_ASSERT_RC1(ht); if (ht->nTableSize >= HT_MAX_SIZE) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket)); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket)); } ht->nTableSize += ht->nTableSize; HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE_EX(ht->nTableSize, HT_MIN_MASK), HT_USED_SIZE(ht), GC_FLAGS(ht) & IS_ARRAY_PERSISTENT)); @@ -1164,7 +1171,7 @@ static void ZEND_FASTCALL zend_hash_do_r pefree(old_data, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT); zend_hash_rehash(ht); } else { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket)); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket)); } } Index: php-7.4.33/Zend/zend_hash.h =================================================================== --- php-7.4.33.orig/Zend/zend_hash.h +++ php-7.4.33/Zend/zend_hash.h @@ -296,6 +296,7 @@ ZEND_API int ZEND_FASTCALL zend_hash_reh #endif ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void); +ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void); ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size); ZEND_API HashTable* ZEND_FASTCALL zend_new_pair(zval *val1, zval *val2); ZEND_API uint32_t zend_array_count(HashTable *ht); Index: php-7.4.33/Zend/zend_llist.c =================================================================== --- php-7.4.33.orig/Zend/zend_llist.c +++ php-7.4.33/Zend/zend_llist.c @@ -112,6 +112,8 @@ ZEND_API void zend_llist_destroy(zend_ll current = next; } + l->head = NULL; + l->tail = NULL; l->count = 0; } Index: php-7.4.33/Zend/zend_multiply.h =================================================================== --- php-7.4.33.orig/Zend/zend_multiply.h +++ php-7.4.33/Zend/zend_multiply.h @@ -321,7 +321,7 @@ static zend_always_inline size_t zend_sa size_t ret = zend_safe_address(nmemb, size, offset, &overflow); if (UNEXPECTED(overflow)) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset); + zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset); return 0; } return ret; @@ -334,7 +334,7 @@ static zend_always_inline size_t zend_sa size_t ret = zend_safe_address(nmemb, size, offset, &overflow); if (UNEXPECTED(overflow)) { - zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset); + zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset); return 0; } return ret; Index: php-7.4.33/Zend/zend_strtod.c =================================================================== --- php-7.4.33.orig/Zend/zend_strtod.c +++ php-7.4.33/Zend/zend_strtod.c @@ -603,7 +603,7 @@ Balloc rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong)); if (!rv) { FREE_DTOA_LOCK(0); - zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory"); + zend_mm_safe_error_ex("Balloc() failed to allocate memory"); } #else len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1) @@ -616,7 +616,7 @@ Balloc rv = (Bigint*)MALLOC(len*sizeof(double)); if (!rv) { FREE_DTOA_LOCK(0); - zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory"); + zend_mm_safe_error_ex("Balloc() failed to allocate memory"); } #endif rv->k = k; Index: php-7.4.33/Zend/zend_types.h =================================================================== --- php-7.4.33.orig/Zend/zend_types.h +++ php-7.4.33/Zend/zend_types.h @@ -330,17 +330,21 @@ struct _zend_array { # define HT_HASH_RESET(ht) do { \ char *p = (char*)&HT_HASH(ht, (ht)->nTableMask); \ size_t size = HT_HASH_SIZE((ht)->nTableMask); \ - __m128i xmm0 = _mm_setzero_si128(); \ - xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \ - ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \ - do { \ - _mm_storeu_si128((__m128i*)p, xmm0); \ - _mm_storeu_si128((__m128i*)(p+16), xmm0); \ - _mm_storeu_si128((__m128i*)(p+32), xmm0); \ - _mm_storeu_si128((__m128i*)(p+48), xmm0); \ - p += 64; \ - size -= 64; \ - } while (size != 0); \ + if (UNEXPECTED(size < 64)) { \ + memset(p, HT_INVALID_IDX, size); \ + } else { \ + __m128i xmm0 = _mm_setzero_si128(); \ + xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \ + ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \ + do { \ + _mm_storeu_si128((__m128i*)p, xmm0); \ + _mm_storeu_si128((__m128i*)(p+16), xmm0); \ + _mm_storeu_si128((__m128i*)(p+32), xmm0); \ + _mm_storeu_si128((__m128i*)(p+48), xmm0); \ + p += 64; \ + size -= 64; \ + } while (size != 0); \ + } \ } while (0) #else # define HT_HASH_RESET(ht) \ Index: php-7.4.33/Zend/zend_vm_def.h =================================================================== --- php-7.4.33.orig/Zend/zend_vm_def.h +++ php-7.4.33/Zend/zend_vm_def.h @@ -417,7 +417,7 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TM size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -426,6 +426,9 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TM zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -3210,6 +3213,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -3217,6 +3223,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); Index: php-7.4.33/Zend/zend_vm_execute.h =================================================================== --- php-7.4.33.orig/Zend/zend_vm_execute.h +++ php-7.4.33/Zend/zend_vm_execute.h @@ -5631,6 +5631,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -5638,6 +5641,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_ zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -7491,6 +7497,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -7498,6 +7507,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -7900,7 +7912,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -7909,6 +7921,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -9952,6 +9967,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -9959,6 +9977,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -10361,7 +10382,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -10370,6 +10391,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -13928,6 +13952,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -13935,6 +13962,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -14681,7 +14711,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -14690,6 +14720,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -15353,7 +15386,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -15362,6 +15395,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -16107,6 +16143,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -16114,6 +16153,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -17040,7 +17082,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -17049,6 +17091,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -17401,6 +17446,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -17408,6 +17456,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -38348,7 +38399,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -38357,6 +38408,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -40727,7 +40781,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -40736,6 +40790,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -41849,6 +41906,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -41856,6 +41916,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -44132,6 +44195,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -44139,6 +44205,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -46857,7 +46926,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST size_t len = ZSTR_LEN(op1_str); if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { - zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation"); + zend_mm_safe_error_ex("Integer overflow in memory allocation"); } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -46866,6 +46935,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); @@ -49268,6 +49340,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) { size_t len = ZSTR_LEN(op1_str); + if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); ZVAL_NEW_STR(EX_VAR(opline->result.var), str); @@ -49275,6 +49350,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FAST zend_string_release_ex(op2_str, 0); } } else { + if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) { + zend_mm_safe_error_ex("Integer overflow in memory allocation"); + } str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0); memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str)); memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1); Index: php-7.4.33/ext/session/session.c =================================================================== --- php-7.4.33.orig/ext/session/session.c +++ php-7.4.33/ext/session/session.c @@ -3174,7 +3174,7 @@ static int php_session_rfc1867_callback( if (php_session_rfc1867_orig_callback) { retval = php_session_rfc1867_orig_callback(event, event_data, extra); } - if (!PS(rfc1867_enabled)) { + if (!PS(rfc1867_enabled) || true) { return retval; } Index: php-7.4.33/main/SAPI.c =================================================================== --- php-7.4.33.orig/main/SAPI.c +++ php-7.4.33/main/SAPI.c @@ -509,18 +509,23 @@ SAPI_API void sapi_deactivate(void) } if (SG(request_info).auth_user) { efree(SG(request_info).auth_user); + SG(request_info).auth_user = NULL; } if (SG(request_info).auth_password) { efree(SG(request_info).auth_password); + SG(request_info).auth_password = NULL; } if (SG(request_info).auth_digest) { efree(SG(request_info).auth_digest); + SG(request_info).auth_digest = NULL; } if (SG(request_info).content_type_dup) { efree(SG(request_info).content_type_dup); + SG(request_info).content_type_dup = NULL; } if (SG(request_info).current_user) { efree(SG(request_info).current_user); + SG(request_info).current_user = NULL; } if (sapi_module.deactivate) { sapi_module.deactivate(); Index: php-7.4.33/main/main.c =================================================================== --- php-7.4.33.orig/main/main.c +++ php-7.4.33/main/main.c @@ -1961,6 +1961,8 @@ void php_request_shutdown(void *dummy) for (i=0; i<NUM_TRACK_VARS; i++) { zval_ptr_dtor(&PG(http_globals)[i]); + /* May be accessed before php_request_startup() */ + ZVAL_UNDEF(&PG(http_globals)[i]); } } zend_end_try(); @@ -2013,6 +2015,9 @@ void php_request_shutdown(void *dummy) #ifdef HAVE_DTRACE DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method)); #endif /* HAVE_DTRACE */ + + /* May be accessed before php_request_startup() */ + PG(modules_activated) = 0; } /* }}} */ Index: php-7.4.33/main/php_variables.c =================================================================== --- php-7.4.33.orig/main/php_variables.c +++ php-7.4.33/main/php_variables.c @@ -219,7 +219,7 @@ PHPAPI void php_register_variable_ex(cha } if (!index) { - array_init(&gpc_element); + array_init_singleton(&gpc_element); if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) { zend_array_destroy(Z_ARR(gpc_element)); zval_ptr_dtor_nogc(val); @@ -236,7 +236,7 @@ PHPAPI void php_register_variable_ex(cha gpc_element_p = zend_symtable_str_find(symtable1, index, index_len); if (!gpc_element_p) { zval tmp; - array_init(&tmp); + array_init_singleton(&tmp); gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp); } else { if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) { @@ -244,7 +244,7 @@ PHPAPI void php_register_variable_ex(cha } if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) { zval_ptr_dtor_nogc(gpc_element_p); - array_init(gpc_element_p); + array_init_singleton(gpc_element_p); } else { SEPARATE_ARRAY(gpc_element_p); } @@ -442,7 +442,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_defaul case PARSE_POST: case PARSE_GET: case PARSE_COOKIE: - array_init(&array); + array_init_singleton(&array); switch (arg) { case PARSE_POST: zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]); Index: php-7.4.33/main/rfc1867.c =================================================================== --- php-7.4.33.orig/main/rfc1867.c +++ php-7.4.33/main/rfc1867.c @@ -397,6 +397,14 @@ static int find_boundary(multipart_buffe return 0; } +static zend_bool php_mime_should_save_hdr(const char *name) +{ + return !strcasecmp(name, "Content-Disposition") + || !strcasecmp(name, "Content-Type"); +} + +static char *php_mime_get_hdr_value(zend_llist header, char *key); + /* parse headers */ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header) { @@ -437,10 +445,16 @@ static int multipart_buffer_headers(mult } *value = '\0'; - do { value++; } while (isspace((unsigned char)*value)); - key = estrdup(line); - smart_string_appends(&buf_value, value); + /* Keep only headers we use, and ignore duplicates */ + if (!php_mime_should_save_hdr(line) + || php_mime_get_hdr_value(*header, line)) { + key = NULL; + } else { + key = estrdup(line); + do { value++; } while (isspace((unsigned char)*value)); + smart_string_appends(&buf_value, value); + } } else if (buf_value.c) { /* If no ':' on the line, add to previous line */ smart_string_appends(&buf_value, line); } else { @@ -514,11 +528,11 @@ static char *php_ap_getword(const zend_e return res; } -static char *substring_conf(char *start, int len, char quote) +static char *substring_conf(char *start, size_t len, char quote) { char *result = emalloc(len + 1); char *resp = result; - int i; + size_t i; for (i = 0; i < len && start[i] != quote; ++i) { if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) { @@ -546,14 +560,14 @@ static char *php_ap_getword_conf(const z char quote = *str; str++; - return substring_conf(str, (int)strlen(str), quote); + return substring_conf(str, strlen(str), quote); } else { char *strend = str; while (*strend && !isspace((unsigned char)*strend)) { ++strend; } - return substring_conf(str, strend - str, 0); + return substring_conf(str, (size_t)(strend - str), 0); } }
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.