Incorrect handling of paths with NULs, related to bug 69353

Sec Bug #69719	Incorrect handling of paths with NULs, related to bug 69353
Submitted:	2015-05-28 12:00 UTC	Modified:	2016-02-11 12:48 UTC
From:	thoger at redhat dot com	Assigned:	stas (profile)
Status:	Closed	Package:	*General Issues
PHP Version:	5.6.9	OS:
Private report:	No	CVE-ID:	2015-4598

[2015-05-28 12:00 UTC] thoger at redhat dot com

Description:
------------
Fix for bug 69353 addresses multiple issues of PHP APIs accepting paths with NUL character and passing truncated paths to underlying libraries.

https://bugs.php.net/bug.php?id=69353
http://git.php.net/?p=php-src.git;a=commitdiff;h=52b93f0cfd3cba7ff98cc5198df6ca4f23865f80

Reviewing the changes, I noticed following inconsistencies:

* DOMDocument's load functions were fixed, but not save:

$ ./sapi/cli/php -r '$d = new DOMDocument(); $d->loadHTMLFile("/etc/issue"); @unlink("output"); $d->save("output\0extra"); var_dump(file_exists("output"));'
bool(true)

$ ./sapi/cli/php -r '$d = new DOMDocument(); $d->loadHTMLFile("/etc/issue"); @unlink("output"); $d->saveHTMLFile("output\0extra"); var_dump(file_exists("output"));'
bool(true)

* GD imagepsencodefont() was fixed. That has to be called after imagepsloadfont() and that still passes 's' format to zend_parse_parameters().  I've not tested this one as I don't have build with Type1 font support available.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2015-05-28 18:11 UTC] cmb@php.net

-Type: Bug +Type: Security -Private report: No +Private report: Yes

[2015-06-10 04:40 UTC] stas@php.net

-Status: Open +Status: Closed -Assigned To: +Assigned To: stas

[2015-06-10 04:40 UTC] stas@php.net

The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.