From 8b01a28bad638c3ef5809cdee2127409971f18ff Mon Sep 17 00:00:00 2001 From: Rasmus Lerdorf Date: Wed, 21 Mar 2012 09:13:06 -0700 Subject: Add open_basedir checks to readline_write_history and readline_read_history --- ext/readline/readline.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ext/readline/readline.c b/ext/readline/readline.c index c514cb8fd0..820e4b456a 100644 --- a/ext/readline/readline.c +++ b/ext/readline/readline.c @@ -369,6 +369,10 @@ PHP_FUNCTION(readline_read_history) return; } + if (php_check_open_basedir(arg TSRMLS_CC)) { + RETURN_FALSE; + } + /* XXX from & to NYI */ if (read_history(arg)) { RETURN_FALSE; @@ -389,6 +393,10 @@ PHP_FUNCTION(readline_write_history) return; } + if (php_check_open_basedir(arg TSRMLS_CC)) { + RETURN_FALSE; + } + if (write_history(arg)) { RETURN_FALSE; } else { -- cgit v1.2.1 From 24a57ae9a5e3e3bc5472a901e0eaff4d70eb281a Mon Sep 17 00:00:00 2001 From: Rasmus Lerdorf Date: Wed, 21 Mar 2012 09:15:35 -0700 Subject: NEWS entry for readline fix --- NEWS | 2 ++ 1 file changed, 2 insertions(+) diff --git a/NEWS b/NEWS index 7563155c76..1658cdbd7a 100644 --- a/NEWS +++ b/NEWS @@ -71,6 +71,8 @@ PHP NEWS - Readline: . Fixed bug #61088 (Memory leak in readline_callback_handler_install). (Nikic, Laruence) + . Add open_basedir checks to readline_write_history and readline_read_history. + (Rasmus, reported by Mateusz Goik) - Reflection: . Fixed bug #61388 (ReflectionObject:getProperties() issues invalid reads -- cgit v1.2.1 From 900778731c49611e1318e4d1839768eb46f26813 Mon Sep 17 00:00:00 2001 From: Rasmus Lerdorf Date: Sun, 25 Mar 2012 05:32:21 +0530 Subject: open_basedir check for linkinfo --- ext/standard/link.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/ext/standard/link.c b/ext/standard/link.c index 9fa2524faf..cb42408f6d 100644 --- a/ext/standard/link.c +++ b/ext/standard/link.c @@ -94,7 +94,8 @@ PHP_FUNCTION(readlink) PHP_FUNCTION(linkinfo) { char *link; - int link_len; + char *dirname; + int link_len, dir_len; struct stat sb; int ret; @@ -102,12 +103,22 @@ PHP_FUNCTION(linkinfo) return; } + dirname = estrndup(link, link_len); + dir_len = php_dirname(dirname, link_len); + + if (php_check_open_basedir(dirname TSRMLS_CC)) { + efree(dirname); + RETURN_FALSE; + } + ret = VCWD_LSTAT(link, &sb); if (ret == -1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", strerror(errno)); + efree(dirname); RETURN_LONG(-1L); } + efree(dirname); RETURN_LONG((long) sb.st_dev); } /* }}} */ -- cgit v1.2.1 From 167e2fd78224887144496cdec2089cd5b2f3312d Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 25 Mar 2012 12:50:25 -0700 Subject: fix bug #61367 - open_basedir bypass using libxml RSHUTDOWN --- NEWS | 4 +++ ext/libxml/libxml.c | 10 +++---- ext/libxml/tests/bug61367-read.phpt | 58 ++++++++++++++++++++++++++++++++++++ ext/libxml/tests/bug61367-write.phpt | 48 +++++++++++++++++++++++++++++ 4 files changed, 115 insertions(+), 5 deletions(-) create mode 100644 ext/libxml/tests/bug61367-read.phpt create mode 100644 ext/libxml/tests/bug61367-write.phpt diff --git a/NEWS b/NEWS index 1658cdbd7a..366315dc7f 100644 --- a/NEWS +++ b/NEWS @@ -42,6 +42,10 @@ PHP NEWS - Firebird Database extension (ibase): . Fixed bug #60802 (ibase_trans() gives segfault when passing params). +- Libxml: + . Fixed bug #61367 (open_basedir bypass using libxml RSHUTDOWN). + (Tim Starling) + - mysqli . Fixed bug #61003 (mysql_stat() require a valid connection). (Johannes). diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c index cf20598fa5..515d58ea6a 100644 --- a/ext/libxml/libxml.c +++ b/ext/libxml/libxml.c @@ -82,8 +82,8 @@ ZEND_GET_MODULE(libxml) static PHP_MINIT_FUNCTION(libxml); static PHP_RINIT_FUNCTION(libxml); static PHP_MSHUTDOWN_FUNCTION(libxml); -static PHP_RSHUTDOWN_FUNCTION(libxml); static PHP_MINFO_FUNCTION(libxml); +static int php_libxml_post_deactivate(); /* }}} */ @@ -129,13 +129,13 @@ zend_module_entry libxml_module_entry = { PHP_MINIT(libxml), /* extension-wide startup function */ PHP_MSHUTDOWN(libxml), /* extension-wide shutdown function */ PHP_RINIT(libxml), /* per-request startup function */ - PHP_RSHUTDOWN(libxml), /* per-request shutdown function */ + NULL, /* per-request shutdown function */ PHP_MINFO(libxml), /* information function */ NO_VERSION_YET, PHP_MODULE_GLOBALS(libxml), /* globals descriptor */ PHP_GINIT(libxml), /* globals ctor */ NULL, /* globals dtor */ - NULL, /* post deactivate */ + php_libxml_post_deactivate, /* post deactivate */ STANDARD_MODULE_PROPERTIES_EX }; @@ -655,9 +655,9 @@ static PHP_MSHUTDOWN_FUNCTION(libxml) return SUCCESS; } - -static PHP_RSHUTDOWN_FUNCTION(libxml) +static int php_libxml_post_deactivate() { + TSRMLS_FETCH(); /* reset libxml generic error handling */ xmlSetGenericErrorFunc(NULL, NULL); xmlSetStructuredErrorFunc(NULL, NULL); diff --git a/ext/libxml/tests/bug61367-read.phpt b/ext/libxml/tests/bug61367-read.phpt new file mode 100644 index 0000000000..722b8e704e --- /dev/null +++ b/ext/libxml/tests/bug61367-read.phpt @@ -0,0 +1,58 @@ +--TEST-- +Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test +--SKIPIF-- + +--INI-- +open_basedir=. +; Suppress spurious "Trying to get property of non-object" notices +error_reporting=E_ALL & ~E_NOTICE +--FILE-- +resolveExternals = true; + $doc->substituteEntities = true; + $dir = htmlspecialchars(dirname(getcwd())); + $doc->loadXML( << +]> +&file; +XML + ); + print $doc->documentElement->firstChild->nodeValue; + } + + public function stream_open ( $path , $mode , $options , &$opened_path ) { + return true; + } +} + +var_dump(mkdir('test_bug_61367')); +var_dump(mkdir('test_bug_61367/base')); +var_dump(file_put_contents('test_bug_61367/bad', 'blah')); +var_dump(chdir('test_bug_61367/base')); + +stream_wrapper_register( 'exploit', 'StreamExploiter' ); +$s = fopen( 'exploit://', 'r' ); + +?> +--CLEAN-- + +--EXPECTF-- +bool(true) +bool(true) +int(4) +bool(true) + +Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "file:///%s/test_bug_61367/bad" in %s on line %d + +Warning: DOMDocument::loadXML(): Failure to process entity file in Entity, line: 4 in %s on line %d + +Warning: DOMDocument::loadXML(): Entity 'file' not defined in Entity, line: 4 in %s on line %d diff --git a/ext/libxml/tests/bug61367-write.phpt b/ext/libxml/tests/bug61367-write.phpt new file mode 100644 index 0000000000..aeed688ff9 --- /dev/null +++ b/ext/libxml/tests/bug61367-write.phpt @@ -0,0 +1,48 @@ +--TEST-- +Bug #61367: open_basedir bypass in libxml RSHUTDOWN: write test +--SKIPIF-- + +--INI-- +open_basedir=. +; Suppress spurious "Trying to get property of non-object" notices +error_reporting=E_ALL & ~E_NOTICE +--FILE-- +appendChild($doc->createTextNode('hello')); + var_dump($doc->save(dirname(getcwd()) . '/bad')); + } + + public function stream_open ( $path , $mode , $options , &$opened_path ) { + return true; + } +} + +var_dump(mkdir('test_bug_61367')); +var_dump(mkdir('test_bug_61367/base')); +var_dump(file_put_contents('test_bug_61367/bad', 'blah')); +var_dump(chdir('test_bug_61367/base')); + +stream_wrapper_register( 'exploit', 'StreamExploiter' ); +$s = fopen( 'exploit://', 'r' ); + +?> +--CLEAN-- + +--EXPECTF-- +bool(true) +bool(true) +int(4) +bool(true) + +Warning: DOMDocument::save(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (.) in %s on line %d + +Warning: DOMDocument::save(%s): failed to open stream: Operation not permitted in %s on line %d +bool(false) -- cgit v1.2.1