diff options
| author | Remi Collet <remi@remirepo.net> | 2020-04-14 11:01:37 +0200 |
|---|---|---|
| committer | Remi Collet <remi@remirepo.net> | 2020-04-14 11:01:37 +0200 |
| commit | 37eeab3864b96768419ed0ee5492bca293ad003c (patch) | |
| tree | c68f5d91ccf631818ef020a8956739e591575a41 /php-bug79330.patch | |
| parent | 9f6be3ba3d21582ce2bc0e2934e8bc3c71b18b38 (diff) | |
standard:
Fix #79330 shell_exec silently truncates after a null byte
Fix #79465 OOB Read in urldecode
CVE-2020-7067
Diffstat (limited to 'php-bug79330.patch')
| -rw-r--r-- | php-bug79330.patch | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/php-bug79330.patch b/php-bug79330.patch new file mode 100644 index 0000000..4698880 --- /dev/null +++ b/php-bug79330.patch @@ -0,0 +1,31 @@ +From edd1ff390be461e9ae5c69237358beddee4655a4 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <stas@php.net> +Date: Mon, 13 Apr 2020 21:00:44 -0700 +Subject: [PATCH] Fix bug #79330 - make all execution modes consistent in + rejecting \0 + +(cherry picked from commit 14fcc813948254b84f382ff537247d8a7e5e0e62) +--- + ext/standard/exec.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/ext/standard/exec.c b/ext/standard/exec.c +index 8af11801ad..02d9539f73 100644 +--- a/ext/standard/exec.c ++++ b/ext/standard/exec.c +@@ -524,6 +524,15 @@ PHP_FUNCTION(shell_exec) + return; + } + ++ if (!command_len) { ++ php_error_docref(NULL, E_WARNING, "Cannot execute a blank command"); ++ RETURN_FALSE; ++ } ++ if (strlen(command) != command_len) { ++ php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack"); ++ RETURN_FALSE; ++ } ++ + #ifdef PHP_WIN32 + if ((in=VCWD_POPEN(command, "rt"))==NULL) { + #else |