Merge branch 'PHP-8.1' into PHP-8.2

This commit is contained in:
Jakub Zelenka 2023-02-14 11:00:20 +00:00
commit cbf089018b
No known key found for this signature in database
GPG Key ID: 1C0779DC5C0A9DE4
7 changed files with 268 additions and 13 deletions

14
NEWS
View File

@ -1,6 +1,6 @@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.2.3
?? ??? ????, PHP 8.2.4
- Core:
. Fixed incorrect check condition in ZEND_YIELD. (nielsdos)
@ -70,6 +70,18 @@ PHP NEWS
. Fix memory leaks when attempting to open a non-existing file or a file over
4GB. (Girgias)
14 Feb 2023, PHP 8.2.3
- Core:
. Fixed bug #81744 (Password_verify() always return true with some hash).
(CVE-2023-0567). (Tim Düsterhus)
. Fixed bug #81746 (1-byte array overrun in common path resolve code).
(CVE-2023-0568). (Niels Dossche)
- SAPI:
. Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
request body). (CVE-2023-0662) (Jakub Zelenka)
02 Feb 2023, PHP 8.2.2
- Core:

View File

@ -748,6 +748,7 @@ PHP_INI_BEGIN()
PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, NULL)
PHP_INI_ENTRY("disable_classes", "", PHP_INI_SYSTEM, NULL)
PHP_INI_ENTRY("max_file_uploads", "20", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
PHP_INI_ENTRY("max_multipart_body_parts", "-1", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
STD_PHP_INI_BOOLEAN("allow_url_fopen", "1", PHP_INI_SYSTEM, OnUpdateBool, allow_url_fopen, php_core_globals, core_globals)
STD_PHP_INI_BOOLEAN("allow_url_include", "0", PHP_INI_SYSTEM, OnUpdateBool, allow_url_include, php_core_globals, core_globals)

View File

@ -686,6 +686,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
void *event_extra_data = NULL;
unsigned int llen = 0;
int upload_cnt = INI_INT("max_file_uploads");
int body_parts_cnt = INI_INT("max_multipart_body_parts");
const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding();
php_rfc1867_getword_t getword;
php_rfc1867_getword_conf_t getword_conf;
@ -707,6 +708,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
return;
}
if (body_parts_cnt < 0) {
body_parts_cnt = PG(max_input_vars) + upload_cnt;
}
int body_parts_limit = body_parts_cnt;
/* Get the boundary */
boundary = strstr(content_type_dup, "boundary");
if (!boundary) {
@ -791,6 +797,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
char *pair = NULL;
int end = 0;
if (--body_parts_cnt < 0) {
php_error_docref(NULL, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
goto fileupload_done;
}
while (isspace(*cd)) {
++cd;
}
@ -910,7 +921,10 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
skip_upload = 1;
} else if (upload_cnt <= 0) {
skip_upload = 1;
sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
if (upload_cnt == 0) {
--upload_cnt;
sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
}
}
/* Return with an error if the posted data is garbled */

View File

@ -0,0 +1,53 @@
--TEST--
FPM: GHSA-54hq-v5wp-fqgv - max_multipart_body_parts ini custom value
--SKIPIF--
<?php include "skipif.inc"; ?>
--FILE--
<?php
require_once "tester.inc";
$cfg = <<<EOT
[global]
error_log = {{FILE:LOG}}
[unconfined]
listen = {{ADDR}}
pm = dynamic
pm.max_children = 5
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 3
php_admin_value[html_errors] = false
php_admin_value[max_input_vars] = 20
php_admin_value[max_file_uploads] = 5
php_admin_value[max_multipart_body_parts] = 10
php_flag[display_errors] = On
EOT;
$code = <<<EOT
<?php
var_dump(count(\$_POST));
EOT;
$tester = new FPM\Tester($cfg, $code);
$tester->start();
$tester->expectLogStartNotices();
echo $tester
->request(stdin: [
'parts' => [
'count' => 30,
]
])
->getBody();
$tester->terminate();
$tester->close();
?>
--EXPECT--
Warning: PHP Request Startup: Multipart body parts limit exceeded 10. To increase the limit change max_multipart_body_parts in php.ini. in Unknown on line 0
int(10)
--CLEAN--
<?php
require_once "tester.inc";
FPM\Tester::clean();
?>

View File

@ -0,0 +1,54 @@
--TEST--
FPM: GHSA-54hq-v5wp-fqgv - max_multipart_body_parts ini default
--SKIPIF--
<?php include "skipif.inc"; ?>
--FILE--
<?php
require_once "tester.inc";
$cfg = <<<EOT
[global]
error_log = {{FILE:LOG}}
[unconfined]
listen = {{ADDR}}
pm = dynamic
pm.max_children = 5
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 3
php_admin_value[html_errors] = false
php_admin_value[max_input_vars] = 20
php_admin_value[max_file_uploads] = 5
php_flag[display_errors] = On
EOT;
$code = <<<EOT
<?php
var_dump(count(\$_POST));
EOT;
$tester = new FPM\Tester($cfg, $code);
$tester->start();
$tester->expectLogStartNotices();
echo $tester
->request(stdin: [
'parts' => [
'count' => 30,
]
])
->getBody();
$tester->terminate();
$tester->close();
?>
--EXPECT--
Warning: PHP Request Startup: Input variables exceeded 20. To increase the limit change max_input_vars in php.ini. in Unknown on line 0
Warning: PHP Request Startup: Multipart body parts limit exceeded 25. To increase the limit change max_multipart_body_parts in php.ini. in Unknown on line 0
int(20)
--CLEAN--
<?php
require_once "tester.inc";
FPM\Tester::clean();
?>

View File

@ -0,0 +1,52 @@
--TEST--
FPM: GHSA-54hq-v5wp-fqgv - exceeding max_file_uploads
--SKIPIF--
<?php include "skipif.inc"; ?>
--FILE--
<?php
require_once "tester.inc";
$cfg = <<<EOT
[global]
error_log = {{FILE:LOG}}
[unconfined]
listen = {{ADDR}}
pm = dynamic
pm.max_children = 5
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 3
php_admin_value[html_errors] = false
php_admin_value[max_file_uploads] = 5
php_flag[display_errors] = On
EOT;
$code = <<<EOT
<?php
var_dump(count(\$_FILES));
EOT;
$tester = new FPM\Tester($cfg, $code);
$tester->start();
$tester->expectLogStartNotices();
echo $tester
->request(stdin: [
'parts' => [
'count' => 10,
'param' => 'filename'
]
])
->getBody();
$tester->terminate();
$tester->close();
?>
--EXPECT--
Warning: Maximum number of allowable file uploads has been exceeded in Unknown on line 0
int(5)
--CLEAN--
<?php
require_once "tester.inc";
FPM\Tester::clean();
?>

View File

@ -651,21 +651,86 @@ class Tester
});
}
/**
* Parse stdin and generate data for multipart config.
*
* @param array $stdin
* @param array $headers
*
* @return void
* @throws \Exception
*/
private function parseStdin(array $stdin, array &$headers)
{
$parts = $stdin['parts'] ?? null;
if (empty($parts)) {
throw new \Exception('The stdin array needs to contain parts');
}
$boundary = $stdin['boundary'] ?? 'AaB03x';
if ( ! isset($headers['CONTENT_TYPE'])) {
$headers['CONTENT_TYPE'] = 'multipart/form-data; boundary=' . $boundary;
}
$count = $parts['count'] ?? null;
if ( ! is_null($count)) {
$dispositionType = $parts['disposition'] ?? 'form-data';
$dispositionParam = $parts['param'] ?? 'name';
$namePrefix = $parts['prefix'] ?? 'f';
$nameSuffix = $parts['suffix'] ?? '';
$value = $parts['value'] ?? 'test';
$parts = [];
for ($i = 0; $i < $count; $i++) {
$parts[] = [
'disposition' => $dispositionType,
'param' => $dispositionParam,
'name' => "$namePrefix$i$nameSuffix",
'value' => $value
];
}
}
$out = '';
$nl = "\r\n";
foreach ($parts as $part) {
if (!is_array($part)) {
$part = ['name' => $part];
} elseif ( ! isset($part['name'])) {
throw new \Exception('Each part has to have a name');
}
$name = $part['name'];
$dispositionType = $part['disposition'] ?? 'form-data';
$dispositionParam = $part['param'] ?? 'name';
$value = $part['value'] ?? 'test';
$partHeaders = $part['headers'] ?? [];
$out .= "--$boundary$nl";
$out .= "Content-disposition: $dispositionType; $dispositionParam=\"$name\"$nl";
foreach ($partHeaders as $headerName => $headerValue) {
$out .= "$headerName: $headerValue$nl";
}
$out .= $nl;
$out .= "$value$nl";
}
$out .= "--$boundary--$nl";
return $out;
}
/**
* Execute request.
*
* @param string $query
* @param array $headers
* @param string|null $uri
* @param string|null $address
* @param string|null $successMessage
* @param string|null $errorMessagereadLimit
* @param bool $connKeepAlive
* @param string|null $scriptFilename = null
* @param bool $expectError
* @param int $readLimit
* @param string $query
* @param array $headers
* @param string|null $uri
* @param string|null $address
* @param string|null $successMessage
* @param string|null $errorMessage
* @param bool $connKeepAlive
* @param string|null $scriptFilename = null
* @param string|array|null $stdin = null
* @param bool $expectError
* @param int $readLimit
*
* @return Response
* @throws \Exception
*/
public function request(
string $query = '',
@ -676,7 +741,7 @@ class Tester
string $errorMessage = null,
bool $connKeepAlive = false,
string $scriptFilename = null,
string $stdin = null,
string|array $stdin = null,
bool $expectError = false,
int $readLimit = -1,
): Response {
@ -684,6 +749,10 @@ class Tester
return new Response(null, true);
}
if (is_array($stdin)) {
$stdin = $this->parseStdin($stdin, $headers);
}
$params = $this->getRequestParams($query, $headers, $uri, $scriptFilename, $stdin);
$this->trace('Request params', $params);