More string length checks & fixes

smalyshev · smalyshev · commit bcfb10284226 · 2016-11-03T21:10:52.000-07:00
diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c
@@ -513,7 +513,7 @@ static PHP_FUNCTION(bzcompress)
 	dest_len   = (unsigned int) (source_len + (0.01 * source_len) + 600);
 
 	/* Allocate the destination buffer */
-	dest = emalloc(dest_len + 1);
+	dest = safe_emalloc(dest_len, 1, 1);
 
 	/* Handle the optional arguments */
 	if (argc > 1) {
diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c
@@ -2491,7 +2491,7 @@ PHP_NAMED_FUNCTION(php_if_iconv)
 		&out_buffer, &out_len, out_charset, in_charset);
 	_php_iconv_show_error(err, out_charset, in_charset TSRMLS_CC);
 	if (err == PHP_ICONV_ERR_SUCCESS && out_buffer != NULL) {
-		RETVAL_STRINGL(out_buffer, out_len, 0);
+		RETVAL_STRINGL_CHECK(out_buffer, out_len, 0);
 	} else {
 		if (out_buffer != NULL) {
 			efree(out_buffer);
diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
@@ -3916,7 +3916,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 #define PHP_IMAP_CLEAN	if (bufferTo) efree(bufferTo); if (bufferCc) efree(bufferCc); if (bufferBcc) efree(bufferBcc); if (bufferHeader) efree(bufferHeader);
 #define PHP_IMAP_BAD_DEST PHP_IMAP_CLEAN; efree(tempMailTo); return (BAD_MSG_DESTINATION);
 
-	bufferHeader = (char *)emalloc(bufferLen + 1);
+	bufferHeader = (char *)safe_emalloc(bufferLen, 1, 1);
 	memset(bufferHeader, 0, bufferLen);
 	if (to && *to) {
 		strlcat(bufferHeader, "To: ", bufferLen + 1);
diff --git a/ext/intl/breakiterator/breakiterator_iterators.cpp b/ext/intl/breakiterator/breakiterator_iterators.cpp
@@ -182,7 +182,7 @@ static void _breakiterator_parts_move_forward(zend_object_iterator *iter TSRMLS_
 	}
 	assert(next <= slen && next >= cur);
 	len = next - cur;
-	res = static_cast<char*>(emalloc(len + 1));
+	res = static_cast<char*>(safe_emalloc(len, 1, 1));
 
 	memcpy(res, &s[cur], len);
 	res[len] = '\0';
diff --git a/ext/intl/intl_convert.c b/ext/intl/intl_convert.c
@@ -49,7 +49,7 @@ void intl_convert_utf8_to_utf16(
 	UErrorCode* status )
 {
 	UChar*      dst_buf = NULL;
-	int32_t     dst_len = 0;
+	uint32_t    dst_len = 0;
 
 	/* If *target is NULL determine required destination buffer size (pre-flighting).
 	 * Otherwise, attempt to convert source string; if *target buffer is not large enough
diff --git a/ext/intl/locale/locale_methods.c b/ext/intl/locale/locale_methods.c
@@ -263,6 +263,9 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
 	int32_t     	buflen          = 512;
 	UErrorCode  	status          = U_ZERO_ERROR;
 
+	if (strlen(loc_name) > INTL_MAX_LOCALE_LEN) {
+		return NULL;
+	}
 
 	if( strcmp(tag_name, LOC_CANONICALIZE_TAG) != 0 ){
 		/* Handle  grandfathered languages */
@@ -395,7 +398,7 @@ static void get_icu_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAMETERS)
 	if(loc_name_len == 0) {
 		loc_name = intl_locale_get_default(TSRMLS_C);
 	}
-	
+
 	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
 
 	/* Call ICU get */
@@ -702,6 +705,8 @@ PHP_FUNCTION( locale_get_keywords )
         RETURN_FALSE;
     }
 
+	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
     if(loc_name_len == 0) {
         loc_name = intl_locale_get_default(TSRMLS_C);
     }
@@ -1109,6 +1114,8 @@ PHP_FUNCTION(locale_parse)
         RETURN_FALSE;
     }
 
+    INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
     if(loc_name_len == 0) {
         loc_name = intl_locale_get_default(TSRMLS_C);
     }
diff --git a/ext/intl/msgformat/msgformat_data.c b/ext/intl/msgformat/msgformat_data.c
@@ -80,10 +80,10 @@ msgformat_data* msgformat_data_create( TSRMLS_D )
 /* }}} */
 
 #ifdef MSG_FORMAT_QUOTE_APOS
-int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec) 
+int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec)
 {
 	if(*spattern && *spattern_len && u_strchr(*spattern, (UChar)'\'')) {
-		UChar *npattern = emalloc(sizeof(UChar)*(2*(*spattern_len)+1));
+		UChar *npattern = safe_emalloc(sizeof(UChar)*2, *spattern_len, sizeof(UChar));
 		uint32_t npattern_len;
 		npattern_len = umsg_autoQuoteApostrophe(*spattern, *spattern_len, npattern, 2*(*spattern_len)+1, ec);
 		efree(*spattern);
diff --git a/ext/standard/exec.c b/ext/standard/exec.c
@@ -133,7 +133,7 @@ PHPAPI int php_exec(int type, char *cmd, zval *array, zval *return_value TSRMLS_
 
 	if (type != 3) {
 		b = buf;
-		
+
 		while (php_stream_get_line(stream, b, EXEC_INPUT_BUF, &bufl)) {
 			/* no new line found, let's read some more */
 			if (b[bufl - 1] != '\n' && !php_stream_eof(stream)) {
@@ -330,7 +330,7 @@ PHPAPI char *php_escape_shell_cmd(char *str)
 				cmd[y++] = str[x];
 				break;
 #else
-			/* % is Windows specific for enviromental variables, ^%PATH% will 
+			/* % is Windows specific for enviromental variables, ^%PATH% will
 				output PATH while ^%PATH^% will not. escapeshellcmd will escape all % and !.
 			*/
 			case '%':
@@ -492,7 +492,7 @@ PHP_FUNCTION(escapeshellcmd)
 			return;
 		}
 		cmd = php_escape_shell_cmd(command);
-		RETVAL_STRING(cmd, 0);
+		RETVAL_STRINGL_CHECK(cmd, strlen(cmd), 0);
 	} else {
 		RETVAL_EMPTY_STRING();
 	}
@@ -517,7 +517,7 @@ PHP_FUNCTION(escapeshellarg)
 			return;
 		}
 		cmd = php_escape_shell_arg(argument);
-		RETVAL_STRING(cmd, 0);
+		RETVAL_STRINGL_CHECK(cmd, strlen(cmd), 0);
 	}
 }
 /* }}} */
@@ -551,7 +551,7 @@ PHP_FUNCTION(shell_exec)
 	php_stream_close(stream);
 
 	if (total_readbytes > 0) {
-		RETVAL_STRINGL(ret, total_readbytes, 0);
+		RETVAL_STRINGL_CHECK(ret, total_readbytes, 0);
 	}
 }
 /* }}} */
diff --git a/ext/standard/php_smart_str.h b/ext/standard/php_smart_str.h
@@ -57,7 +57,8 @@
 		newlen = (n);												\
 		(d)->a = newlen < SMART_STR_START_SIZE 						\
 				? SMART_STR_START_SIZE 								\
-				: newlen + SMART_STR_PREALLOC;						\
+				: (newlen >= (INT_MAX - SMART_STR_PREALLOC)? newlen \
+							: (newlen + SMART_STR_PREALLOC));		\
 		SMART_STR_DO_REALLOC(d, what);								\
 	} else {														\
 		newlen = (d)->len + (n);									\
diff --git a/ext/standard/string.c b/ext/standard/string.c
@@ -908,11 +908,7 @@ PHP_FUNCTION(wordwrap)
 		RETURN_FALSE;
 	}
 
-	if (linelength < 0) {
-		/* For BC */
-		linelength = 0;
-	}
-	if (linelength > INT_MAX) {
+	if (linelength < 0 || linelength > INT_MAX) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length should be between 0 and %d", INT_MAX);
 		RETURN_FALSE;
 	}
diff --git a/ext/xmlrpc/libxmlrpc/base64.c b/ext/xmlrpc/libxmlrpc/base64.c
@@ -15,6 +15,7 @@ static const char rcsid[] = "#(@) $Id$";
 /*  ENCODE  --	Encode binary file into base64.  */
 #include <stdlib.h>
 #include <ctype.h>
+#include <limits.h>
 
 #include "base64.h"
 
@@ -31,6 +32,9 @@ void buffer_new(struct buffer_st *b)
 
 void buffer_add(struct buffer_st *b, char c)
 {
+  if ((INT_MAX - b->length) <= 512) {
+		return;
+  }
   *(b->ptr++) = c;
   b->offset++;
   if (b->offset == b->length) {
@@ -54,13 +58,13 @@ void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length)
   int i, hiteof = 0;
   int offset = 0;
   int olen;
-  
+
   olen = 0;
-  
+
   buffer_new(b);
-  
+
   /*	Fill dtable with character encodings.  */
-  
+
   for (i = 0; i < 26; i++) {
     dtable[i] = 'A' + i;
     dtable[26 + i] = 'a' + i;
@@ -70,16 +74,16 @@ void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length)
   }
   dtable[62] = '+';
   dtable[63] = '/';
-  
+
   while (!hiteof) {
     unsigned char igroup[3], ogroup[4];
     int c, n;
-    
+
     igroup[0] = igroup[1] = igroup[2] = 0;
     for (n = 0; n < 3; n++) {
       c = *(source++);
       offset++;
-      if (offset > length) {
+      if (offset > length || offset <= 0) {
 	hiteof = 1;
 	break;
       }
@@ -90,11 +94,11 @@ void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length)
       ogroup[1] = dtable[((igroup[0] & 3) << 4) | (igroup[1] >> 4)];
       ogroup[2] = dtable[((igroup[1] & 0xF) << 2) | (igroup[2] >> 6)];
       ogroup[3] = dtable[igroup[2] & 0x3F];
-      
+
       /* Replace characters in output stream with "=" pad
 	 characters if fewer than three characters were
 	 read from the end of the input stream. */
-      
+
       if (n < 3) {
 	ogroup[3] = '=';
 	if (n < 2) {
diff --git a/ext/xmlrpc/libxmlrpc/simplestring.c b/ext/xmlrpc/libxmlrpc/simplestring.c
@@ -80,6 +80,7 @@ static const char rcsid[] = "#(@) $Id$";
 
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 #include "simplestring.h"
 
 #define my_free(thing)  if(thing) {free(thing); thing = 0;}
@@ -200,7 +201,7 @@ void simplestring_addn(simplestring* target, const char* source, size_t add_len)
          simplestring_init_str(target);
       }
 
-      if((SIZE_MAX - add_len) < target->len || (SIZE_MAX - add_len - 1) < target->len) {
+      if((INT_MAX - add_len) < target->len || (INT_MAX - add_len - 1) < target->len) {
     	  /* check for overflows, if there's a potential overflow do nothing */
     	  return;
       }
diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c
@@ -1701,7 +1701,7 @@ static ZIPARCHIVE_METHOD(addEmptyDir)
 	}
 
 	if (dirname[dirname_len-1] != '/') {
-		s=(char *)emalloc(dirname_len+2);
+		s=(char *)safe_emalloc(dirname_len, 1, 2);
 		strcpy(s, dirname);
 		s[dirname_len] = '/';
 		s[dirname_len+1] = '\0';
@@ -1915,14 +1915,14 @@ static ZIPARCHIVE_METHOD(addFromString)
 
 	ze_obj = (ze_zip_object*) zend_object_store_get_object(this TSRMLS_CC);
 	if (ze_obj->buffers_cnt) {
-		ze_obj->buffers = (char **)erealloc(ze_obj->buffers, sizeof(char *) * (ze_obj->buffers_cnt+1));
+		ze_obj->buffers = (char **)safe_erealloc(ze_obj->buffers, sizeof(char *), (ze_obj->buffers_cnt+1), 0);
 		pos = ze_obj->buffers_cnt++;
 	} else {
 		ze_obj->buffers = (char **)emalloc(sizeof(char *));
 		ze_obj->buffers_cnt++;
 		pos = 0;
 	}
-	ze_obj->buffers[pos] = (char *)emalloc(buffer_len + 1);
+	ze_obj->buffers[pos] = (char *)safe_emalloc(buffer_len, 1, 1);
 	memcpy(ze_obj->buffers[pos], buffer, buffer_len + 1);
 
 	zs = zip_source_buffer(intern, ze_obj->buffers[pos], buffer_len, 0);
diff --git a/ext/zlib/zlib.c b/ext/zlib/zlib.c
@@ -673,7 +673,7 @@ static PHP_FUNCTION(name) \
 	if (SUCCESS != php_zlib_encode(in_buf, in_len, &out_buf, &out_len, encoding, level TSRMLS_CC)) { \
 		RETURN_FALSE; \
 	} \
-	RETURN_STRINGL(out_buf, out_len, 0); \
+	RETVAL_STRINGL_CHECK(out_buf, out_len, 0); \
 }
 
 #define PHP_ZLIB_DECODE_FUNC(name, encoding) \

Original file line number	Diff line number	Diff line change
`@@ -182,7 +182,7 @@ static void _breakiterator_parts_move_forward(zend_object_iterator *iter TSRMLS_`
`182`	`182`	`}`
`183`	`183`	`assert(next <= slen && next >= cur);`
`184`	`184`	`len = next - cur;`
`185`		`- res = static_cast<char*>(emalloc(len + 1));`
	`185`	`+ res = static_cast<char*>(safe_emalloc(len, 1, 1));`
`186`	`186`
`187`	`187`	`memcpy(res, &s[cur], len);`
`188`	`188`	`res[len] = '\0';`
Original file line number	Diff line number	Diff line change
`@@ -49,7 +49,7 @@ void intl_convert_utf8_to_utf16(`
`49`	`49`	`UErrorCode* status )`
`50`	`50`	`{`
`51`	`51`	`UChar* dst_buf = NULL;`
`52`		`- int32_t dst_len = 0;`
	`52`	`+ uint32_t dst_len = 0;`
`53`	`53`
`54`	`54`	`/* If *target is NULL determine required destination buffer size (pre-flighting).`
`55`	`55`	`* Otherwise, attempt to convert source string; if *target buffer is not large enough`
Original file line number	Diff line number	Diff line change
`@@ -263,6 +263,9 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*`
`263`	`263`	`int32_t buflen = 512;`
`264`	`264`	`UErrorCode status = U_ZERO_ERROR;`
`265`	`265`
	`266`	`+ if (strlen(loc_name) > INTL_MAX_LOCALE_LEN) {`
	`267`	`+ return NULL;`
	`268`	`+ }`
`266`	`269`
`267`	`270`	`if( strcmp(tag_name, LOC_CANONICALIZE_TAG) != 0 ){`
`268`	`271`	`/* Handle grandfathered languages */`
`@@ -395,7 +398,7 @@ static void get_icu_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAMETERS)`
`395`	`398`	`if(loc_name_len == 0) {`
`396`	`399`	`loc_name = intl_locale_get_default(TSRMLS_C);`
`397`	`400`	`}`
`398`		`-`
	`401`	`+`
`399`	`402`	`INTL_CHECK_LOCALE_LEN(strlen(loc_name));`
`400`	`403`
`401`	`404`	`/* Call ICU get */`
`@@ -702,6 +705,8 @@ PHP_FUNCTION( locale_get_keywords )`
`702`	`705`	`RETURN_FALSE;`
`703`	`706`	`}`
`704`	`707`
	`708`	`+ INTL_CHECK_LOCALE_LEN(strlen(loc_name));`
	`709`	`+`
`705`	`710`	`if(loc_name_len == 0) {`
`706`	`711`	`loc_name = intl_locale_get_default(TSRMLS_C);`
`707`	`712`	`}`
`@@ -1109,6 +1114,8 @@ PHP_FUNCTION(locale_parse)`
`1109`	`1114`	`RETURN_FALSE;`
`1110`	`1115`	`}`
`1111`	`1116`
	`1117`	`+ INTL_CHECK_LOCALE_LEN(strlen(loc_name));`
	`1118`	`+`
`1112`	`1119`	`if(loc_name_len == 0) {`
`1113`	`1120`	`loc_name = intl_locale_get_default(TSRMLS_C);`
`1114`	`1121`	`}`
Original file line number	Diff line number	Diff line change
`@@ -133,7 +133,7 @@ PHPAPI int php_exec(int type, char cmd, zval array, zval *return_value TSRMLS_`
`133`	`133`
`134`	`134`	`if (type != 3) {`
`135`	`135`	`b = buf;`
`136`		`-`
	`136`	`+`
`137`	`137`	`while (php_stream_get_line(stream, b, EXEC_INPUT_BUF, &bufl)) {`
`138`	`138`	`/* no new line found, let's read some more */`
`139`	`139`	`if (b[bufl - 1] != '\n' && !php_stream_eof(stream)) {`
`@@ -330,7 +330,7 @@ PHPAPI char php_escape_shell_cmd(char str)`
`330`	`330`	`cmd[y++] = str[x];`
`331`	`331`	`break;`
`332`	`332`	`#else`
`333`		`- /* % is Windows specific for enviromental variables, ^%PATH% will`
	`333`	`+ /* % is Windows specific for enviromental variables, ^%PATH% will`
`334`	`334`	`output PATH while ^%PATH^% will not. escapeshellcmd will escape all % and !.`
`335`	`335`	`*/`
`336`	`336`	`case '%':`
`@@ -492,7 +492,7 @@ PHP_FUNCTION(escapeshellcmd)`
`492`	`492`	`return;`
`493`	`493`	`}`
`494`	`494`	`cmd = php_escape_shell_cmd(command);`
`495`		`- RETVAL_STRING(cmd, 0);`
	`495`	`+ RETVAL_STRINGL_CHECK(cmd, strlen(cmd), 0);`
`496`	`496`	`} else {`
`497`	`497`	`RETVAL_EMPTY_STRING();`
`498`	`498`	`}`
`@@ -517,7 +517,7 @@ PHP_FUNCTION(escapeshellarg)`
`517`	`517`	`return;`
`518`	`518`	`}`
`519`	`519`	`cmd = php_escape_shell_arg(argument);`
`520`		`- RETVAL_STRING(cmd, 0);`
	`520`	`+ RETVAL_STRINGL_CHECK(cmd, strlen(cmd), 0);`
`521`	`521`	`}`
`522`	`522`	`}`
`523`	`523`	`/* }}} */`
`@@ -551,7 +551,7 @@ PHP_FUNCTION(shell_exec)`
`551`	`551`	`php_stream_close(stream);`
`552`	`552`
`553`	`553`	`if (total_readbytes > 0) {`
`554`		`- RETVAL_STRINGL(ret, total_readbytes, 0);`
	`554`	`+ RETVAL_STRINGL_CHECK(ret, total_readbytes, 0);`
`555`	`555`	`}`
`556`	`556`	`}`
`557`	`557`	`/* }}} */`
Original file line number	Diff line number	Diff line change
`@@ -908,11 +908,7 @@ PHP_FUNCTION(wordwrap)`
`908`	`908`	`RETURN_FALSE;`
`909`	`909`	`}`
`910`	`910`
`911`		`- if (linelength < 0) {`
`912`		`- /* For BC */`
`913`		`- linelength = 0;`
`914`		`- }`
`915`		`- if (linelength > INT_MAX) {`
	`911`	`+ if (linelength < 0 \|\| linelength > INT_MAX) {`
`916`	`912`	`php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length should be between 0 and %d", INT_MAX);`
`917`	`913`	`RETURN_FALSE;`
`918`	`914`	`}`