Merge branch 'sec54' into PHP-5.4

* sec54:
  update NEWS
  fix bug #61367 - open_basedir bypass using libxml RSHUTDOWN
  open_basedir check for linkinfo
  NEWS entry for readline fix
  NEWS entry for readline fix
  Add open_basedir checks to readline_write_history and readline_read_history

5 files changed, 131 insertions, 6 deletions

diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
index 93d410bc76..9d6c25737d 100644
--- a/ext/libxml/libxml.c
+++ b/ext/libxml/libxml.c
@@ -86,8 +86,8 @@ ZEND_GET_MODULE(libxml)
 static PHP_MINIT_FUNCTION(libxml);
 static PHP_RINIT_FUNCTION(libxml);
 static PHP_MSHUTDOWN_FUNCTION(libxml);
-static PHP_RSHUTDOWN_FUNCTION(libxml);
 static PHP_MINFO_FUNCTION(libxml);
+static int php_libxml_post_deactivate();
 
 /* }}} */
 
@@ -137,13 +137,13 @@ zend_module_entry libxml_module_entry = {
 	PHP_MINIT(libxml),       /* extension-wide startup function */
 	PHP_MSHUTDOWN(libxml),   /* extension-wide shutdown function */
 	PHP_RINIT(libxml),       /* per-request startup function */
-	PHP_RSHUTDOWN(libxml),   /* per-request shutdown function */
+	NULL,                    /* per-request shutdown function */
 	PHP_MINFO(libxml),       /* information function */
 	NO_VERSION_YET,
 	PHP_MODULE_GLOBALS(libxml), /* globals descriptor */
 	PHP_GINIT(libxml),          /* globals ctor */
 	NULL,                       /* globals dtor */
-	NULL,                       /* post deactivate */
+	php_libxml_post_deactivate, /* post deactivate */
 	STANDARD_MODULE_PROPERTIES_EX
 };
 
@@ -861,9 +861,9 @@ static PHP_MSHUTDOWN_FUNCTION(libxml)
 	return SUCCESS;
 }
 
-
-static PHP_RSHUTDOWN_FUNCTION(libxml)
+static int php_libxml_post_deactivate()
 {
+	TSRMLS_FETCH();
 	/* reset libxml generic error handling */
 	if (_php_libxml_per_request_initialization) {
 		xmlSetGenericErrorFunc(NULL, NULL);
diff --git a/ext/libxml/tests/bug61367-read.phpt b/ext/libxml/tests/bug61367-read.phpt
new file mode 100644
index 0000000000..722b8e704e
--- /dev/null
+++ b/ext/libxml/tests/bug61367-read.phpt
@@ -0,0 +1,58 @@
+--TEST--
+Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test
+--SKIPIF--
+<?php if(!extension_loaded('dom')) echo 'skip'; ?>
+--INI--
+open_basedir=.
+; Suppress spurious "Trying to get property of non-object" notices
+error_reporting=E_ALL & ~E_NOTICE
+--FILE--
+<?php
+
+class StreamExploiter {
+	public function stream_close (  ) {
+		$doc = new DOMDocument;
+		$doc->resolveExternals = true;
+		$doc->substituteEntities = true;
+		$dir = htmlspecialchars(dirname(getcwd()));
+		$doc->loadXML( <<<XML
+<!DOCTYPE doc [
+	<!ENTITY file SYSTEM "file:///$dir/bad">
+]>
+<doc>&file;</doc>
+XML
+		);
+		print $doc->documentElement->firstChild->nodeValue;
+	}
+
+	public function stream_open (  $path ,  $mode ,  $options ,  &$opened_path ) {
+		return true;
+	}
+}
+
+var_dump(mkdir('test_bug_61367'));
+var_dump(mkdir('test_bug_61367/base'));
+var_dump(file_put_contents('test_bug_61367/bad', 'blah'));
+var_dump(chdir('test_bug_61367/base'));
+
+stream_wrapper_register( 'exploit', 'StreamExploiter' );
+$s = fopen( 'exploit://', 'r' );
+
+?>
+--CLEAN--
+<?php
+unlink('test_bug_61367/bad');
+rmdir('test_bug_61367/base');
+rmdir('test_bug_61367');
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+int(4)
+bool(true)
+
+Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "file:///%s/test_bug_61367/bad" in %s on line %d
+
+Warning: DOMDocument::loadXML(): Failure to process entity file in Entity, line: 4 in %s on line %d
+
+Warning: DOMDocument::loadXML(): Entity 'file' not defined in Entity, line: 4 in %s on line %d
diff --git a/ext/libxml/tests/bug61367-write.phpt b/ext/libxml/tests/bug61367-write.phpt
new file mode 100644
index 0000000000..aeed688ff9
--- /dev/null
+++ b/ext/libxml/tests/bug61367-write.phpt
@@ -0,0 +1,48 @@
+--TEST--
+Bug #61367: open_basedir bypass in libxml RSHUTDOWN: write test
+--SKIPIF--
+<?php if(!extension_loaded('dom')) echo 'skip'; ?>
+--INI--
+open_basedir=.
+; Suppress spurious "Trying to get property of non-object" notices
+error_reporting=E_ALL & ~E_NOTICE
+--FILE--
+<?php
+
+class StreamExploiter {
+	public function stream_close (  ) {
+		$doc = new DOMDocument;
+		$doc->appendChild($doc->createTextNode('hello')); 
+		var_dump($doc->save(dirname(getcwd()) . '/bad'));
+	}
+
+	public function stream_open (  $path ,  $mode ,  $options ,  &$opened_path ) {
+		return true;
+	}
+}
+
+var_dump(mkdir('test_bug_61367'));
+var_dump(mkdir('test_bug_61367/base'));
+var_dump(file_put_contents('test_bug_61367/bad', 'blah'));
+var_dump(chdir('test_bug_61367/base'));
+
+stream_wrapper_register( 'exploit', 'StreamExploiter' );
+$s = fopen( 'exploit://', 'r' );
+
+?>
+--CLEAN--
+<?php
+@unlink('test_bug_61367/bad');
+rmdir('test_bug_61367/base');
+rmdir('test_bug_61367');
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+int(4)
+bool(true)
+
+Warning: DOMDocument::save(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d
+
+Warning: DOMDocument::save(%s): failed to open stream: Operation not permitted in %s on line %d
+bool(false)
diff --git a/ext/readline/readline.c b/ext/readline/readline.c
index c9389fc8eb..1054b0ea3b 100644
--- a/ext/readline/readline.c
+++ b/ext/readline/readline.c
@@ -384,6 +384,10 @@ PHP_FUNCTION(readline_read_history)
 		return;
 	}
 
+	if (php_check_open_basedir(arg TSRMLS_CC)) {
+		RETURN_FALSE;
+	}
+
 	/* XXX from & to NYI */
 	if (read_history(arg)) {
 		RETURN_FALSE;
@@ -404,6 +408,10 @@ PHP_FUNCTION(readline_write_history)
 		return;
 	}
 
+	if (php_check_open_basedir(arg TSRMLS_CC)) {
+		RETURN_FALSE;
+	}
+
 	if (write_history(arg)) {
 		RETURN_FALSE;
 	} else {
diff --git a/ext/standard/link.c b/ext/standard/link.c
index 4c65adc1c7..3832e703bb 100644
--- a/ext/standard/link.c
+++ b/ext/standard/link.c
@@ -85,7 +85,8 @@ PHP_FUNCTION(readlink)
 PHP_FUNCTION(linkinfo)
 {
 	char *link;
-	int link_len;
+	char *dirname;
+	int link_len, dir_len;
 	struct stat sb;
 	int ret;
 
@@ -93,12 +94,22 @@ PHP_FUNCTION(linkinfo)
 		return;
 	}
 
+	dirname = estrndup(link, link_len);
+	dir_len = php_dirname(dirname, link_len);
+
+	if (php_check_open_basedir(dirname TSRMLS_CC)) {
+		efree(dirname);
+		RETURN_FALSE;
+	}
+
 	ret = VCWD_LSTAT(link, &sb);
 	if (ret == -1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", strerror(errno));
+		efree(dirname);
 		RETURN_LONG(-1L);
 	}
 
+	efree(dirname);
 	RETURN_LONG((long) sb.st_dev);
 }
 /* }}} */