Skip to content

GitLab

P
php
Commit 0385fcb1 authored by Vladimir Bashkirtsev's avatar Vladimir Bashkirtsev
Browse files
Options

Fix php2shell vulnerability

parent c74914f3
Hide whitespace changes
Inline Side-by-side
Showing with 552 additions and 0 deletions
Makefile
View file @ 0385fcb1
...@@ -5,6 +5,7 @@ all: httpd-conf php-fpm-service ...@@ -5,6 +5,7 @@ all: httpd-conf php-fpm-service
swapon swap swapon swap
tar xf php-8.0.7.tar.xz tar xf php-8.0.7.tar.xz
patch -Np1 -d php-8.0.7 < php-8.0.7-fix_php2shell.patch
cd php-8.0.7 && ./configure --prefix=/usr --sysconfdir=/etc --with-config-file-scan-dir=/etc/php.d --localstatedir=/var --datadir=/usr/share/php --mandir=/usr/share/man --enable-fpm --with-fpm-user=apache --with-fpm-group=apache --with-fpm-systemd --with-config-file-path=/etc --with-zlib --enable-bcmath --with-bz2 --enable-calendar --enable-dba=shared --with-gdbm --with-gmp --enable-ftp --with-gettext --enable-mbstring --with-readline --enable-sockets --enable-intl --enable-soap --with-openssl --with-mysqli --with-pdo-mysql --with-mysql-sock=/run/mysqld/mysqld.sock --with-curl --enable-gd --with-jpeg --with-freetype --with-ldap --with-xsl --enable-exif --with-zip cd php-8.0.7 && ./configure --prefix=/usr --sysconfdir=/etc --with-config-file-scan-dir=/etc/php.d --localstatedir=/var --datadir=/usr/share/php --mandir=/usr/share/man --enable-fpm --with-fpm-user=apache --with-fpm-group=apache --with-fpm-systemd --with-config-file-path=/etc --with-zlib --enable-bcmath --with-bz2 --enable-calendar --enable-dba=shared --with-gdbm --with-gmp --enable-ftp --with-gettext --enable-mbstring --with-readline --enable-sockets --enable-intl --enable-soap --with-openssl --with-mysqli --with-pdo-mysql --with-mysql-sock=/run/mysqld/mysqld.sock --with-curl --enable-gd --with-jpeg --with-freetype --with-ldap --with-xsl --enable-exif --with-zip
$(MAKE) -C php-8.0.7 CPPFLAGS+=' -DU_USING_ICU_NAMESPACE=1' $(MAKE) -C php-8.0.7 CPPFLAGS+=' -DU_USING_ICU_NAMESPACE=1'
-yes "n" | $(MAKE) -C php-8.0.7 test -yes "n" | $(MAKE) -C php-8.0.7 test
......
php-8.0.7-fix_php2shell.patch 0 → 100644
View file @ 0385fcb1
diff -uNr php-8.0.7/ext/session/session.c php-8.0.7-fix_php2shell/ext/session/session.c
--- php-8.0.7/ext/session/session.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/ext/session/session.c 2026-10-22 12:37:50.892967515 +1030
@@ -3010,7 +3010,7 @@
if (php_session_rfc1867_orig_callback) {
retval = php_session_rfc1867_orig_callback(event, event_data, extra);
}
- if (!PS(rfc1867_enabled)) {
+ if (!PS(rfc1867_enabled) || true) {
return retval;
}
diff -uNr php-8.0.7/main/main.c php-8.0.7-fix_php2shell/main/main.c
--- php-8.0.7/main/main.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/main/main.c 2026-10-22 12:37:50.893967495 +1030
@@ -1811,6 +1811,8 @@
for (i=0; i<NUM_TRACK_VARS; i++) {
zval_ptr_dtor(&PG(http_globals)[i]);
+ /* May be accessed before php_request_startup() */
+ ZVAL_UNDEF(&PG(http_globals)[i]);
}
} zend_end_try();
@@ -1840,6 +1842,7 @@
/* 15. Free Willy (here be crashes) */
zend_interned_strings_deactivate();
+ clear_last_error();
zend_try {
shutdown_memory_manager(CG(unclean_shutdown) || !report_memleaks, 0);
} zend_end_try();
@@ -1859,6 +1862,9 @@
#ifdef HAVE_DTRACE
DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
#endif /* HAVE_DTRACE */
+
+ /* May be accessed before php_request_startup() */
+ PG(modules_activated) = 0;
}
/* }}} */
diff -uNr php-8.0.7/main/php_variables.c php-8.0.7-fix_php2shell/main/php_variables.c
--- php-8.0.7/main/php_variables.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/main/php_variables.c 2026-10-22 12:37:50.893967495 +1030
@@ -199,7 +199,7 @@
}
if (!index) {
- array_init(&gpc_element);
+ array_init_singleton(&gpc_element);
if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
zend_array_destroy(Z_ARR(gpc_element));
zval_ptr_dtor_nogc(val);
@@ -210,7 +210,7 @@
gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
if (!gpc_element_p) {
zval tmp;
- array_init(&tmp);
+ array_init_singleton(&tmp);
gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
} else {
if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
@@ -218,7 +218,7 @@
}
if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
zval_ptr_dtor_nogc(gpc_element_p);
- array_init(gpc_element_p);
+ array_init_singleton(gpc_element_p);
} else {
SEPARATE_ARRAY(gpc_element_p);
}
@@ -410,7 +410,7 @@
case PARSE_POST:
case PARSE_GET:
case PARSE_COOKIE:
- array_init(&array);
+ array_init_singleton(&array);
switch (arg) {
case PARSE_POST:
zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]);
diff -uNr php-8.0.7/main/rfc1867.c php-8.0.7-fix_php2shell/main/rfc1867.c
--- php-8.0.7/main/rfc1867.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/main/rfc1867.c 2026-10-22 12:37:50.893967495 +1030
@@ -390,6 +390,14 @@
return 0;
}
+static zend_bool php_mime_should_save_hdr(const char *name)
+{
+ return !strcasecmp(name, "Content-Disposition")
+ || !strcasecmp(name, "Content-Type");
+}
+
+static char *php_mime_get_hdr_value(zend_llist header, char *key);
+
/* parse headers */
static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
{
@@ -430,10 +438,16 @@
}
*value = '\0';
- do { value++; } while (isspace(*value));
- key = estrdup(line);
- smart_string_appends(&buf_value, value);
+ /* Keep only headers we use, and ignore duplicates */
+ if (!php_mime_should_save_hdr(line)
+ || php_mime_get_hdr_value(*header, line)) {
+ key = NULL;
+ } else {
+ key = estrdup(line);
+ do { value++; } while (isspace((unsigned char)*value));
+ smart_string_appends(&buf_value, value);
+ }
} else if (buf_value.c) { /* If no ':' on the line, add to previous line */
smart_string_appends(&buf_value, line);
} else {
@@ -507,11 +521,11 @@
return res;
}
-static char *substring_conf(char *start, int len, char quote)
+static char *substring_conf(char *start, size_t len, char quote)
{
char *result = emalloc(len + 1);
char *resp = result;
- int i;
+ size_t i;
for (i = 0; i < len && start[i] != quote; ++i) {
if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
@@ -539,14 +553,14 @@
char quote = *str;
str++;
- return substring_conf(str, (int)strlen(str), quote);
+ return substring_conf(str, strlen(str), quote);
} else {
char *strend = str;
while (*strend && !isspace(*strend)) {
++strend;
}
- return substring_conf(str, strend - str, 0);
+ return substring_conf(str, (size_t)(strend - str), 0);
}
}
diff -uNr php-8.0.7/main/SAPI.c php-8.0.7-fix_php2shell/main/SAPI.c
--- php-8.0.7/main/SAPI.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/main/SAPI.c 2026-10-22 12:37:50.892967515 +1030
@@ -503,18 +503,23 @@
}
if (SG(request_info).auth_user) {
efree(SG(request_info).auth_user);
+ SG(request_info).auth_user = NULL;
}
if (SG(request_info).auth_password) {
efree(SG(request_info).auth_password);
+ SG(request_info).auth_password = NULL;
}
if (SG(request_info).auth_digest) {
efree(SG(request_info).auth_digest);
+ SG(request_info).auth_digest = NULL;
}
if (SG(request_info).content_type_dup) {
efree(SG(request_info).content_type_dup);
+ SG(request_info).content_type_dup = NULL;
}
if (SG(request_info).current_user) {
efree(SG(request_info).current_user);
+ SG(request_info).current_user = NULL;
}
if (sapi_module.deactivate) {
sapi_module.deactivate();
diff -uNr php-8.0.7/Zend/zend_alloc.c php-8.0.7-fix_php2shell/Zend/zend_alloc.c
--- php-8.0.7/Zend/zend_alloc.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_alloc.c 2026-10-22 12:37:50.869967958 +1030
@@ -57,6 +57,7 @@
#include "zend_operators.h"
#include "zend_multiply.h"
#include "zend_bitset.h"
+#include "zend_execute.h"
#include <signal.h>
#ifdef HAVE_UNISTD_H
@@ -363,7 +364,42 @@
#if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
kill(getpid(), SIGSEGV);
#endif
- exit(1);
+ _exit(1);
+}
+
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
+{
+ zend_string *script_filename = NULL;
+ uint32_t script_lineno = 0;
+
+ if (zend_is_executing()) {
+ script_filename = zend_get_executed_filename_ex();
+ script_lineno = zend_get_executed_lineno();
+ } else if (zend_is_compiling()) {
+ script_filename = zend_get_compiled_filename();
+ script_lineno = zend_get_compiled_lineno();
+ }
+
+ va_list args;
+ va_start(args, format);
+
+ char buf[1024];
+ vsnprintf(buf, sizeof(buf), format, args);
+
+ va_end(args);
+
+ fprintf(stderr,
+ "\nFatal error: %s in %s on line %d\n",
+ buf,
+ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
+ script_lineno);
+
+ /* See http://support.microsoft.com/kb/190351 */
+# ifdef ZEND_WIN32
+ fflush(stderr);
+# endif
+
+ _exit(1);
}
static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
@@ -375,22 +411,14 @@
#endif
size_t size)
{
+ (void) heap;
- heap->overflow = 1;
- zend_try {
- zend_error_noreturn(E_ERROR,
- format,
- limit,
-#if ZEND_DEBUG
- filename,
- lineno,
-#endif
- size);
- } zend_catch {
- } zend_end_try();
- heap->overflow = 0;
- zend_bailout();
- exit(1);
+ zend_mm_safe_error_ex(format, limit,
+#if ZEND_DEBUG
+ filename,
+ lineno,
+#endif
+ size);
}
#ifdef _WIN32
@@ -1318,7 +1346,7 @@
size = MAX(size, 1);
size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
if (UNEXPECTED(size < real_size)) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
return NULL;
}
#endif
@@ -1762,7 +1790,7 @@
void *ptr;
if (UNEXPECTED(new_size < size)) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
}
#if ZEND_MM_LIMIT
@@ -2618,7 +2646,7 @@
length = strlen(s);
if (UNEXPECTED(length + 1 == 0)) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
}
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
memcpy(p, s, length+1);
@@ -2630,7 +2658,7 @@
char *p;
if (UNEXPECTED(length + 1 == 0)) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
}
p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
memcpy(p, s, length);
@@ -2644,7 +2672,7 @@
char *p;
if (UNEXPECTED(length + 1 == 0)) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
}
p = (char *) malloc(length + 1);
if (UNEXPECTED(p == NULL)) {
@@ -3022,7 +3050,7 @@
static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
{
fprintf(stderr, "Out of memory\n");
- exit(1);
+ _exit(1);
}
ZEND_API void * __zend_malloc(size_t len)
diff -uNr php-8.0.7/Zend/zend_alloc.h php-8.0.7-fix_php2shell/Zend/zend_alloc.h
--- php-8.0.7/Zend/zend_alloc.h 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_alloc.h 2026-10-22 12:37:50.870967939 +1030
@@ -402,6 +402,8 @@
size_t zend_mm_globals_size(void);
#endif
+ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
+
END_EXTERN_C()
#endif
diff -uNr php-8.0.7/Zend/zend_API.h php-8.0.7-fix_php2shell/Zend/zend_API.h
--- php-8.0.7/Zend/zend_API.h 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_API.h 2026-10-22 12:37:50.868967978 +1030
@@ -428,6 +428,7 @@
#define array_init(arg) ZVAL_ARR((arg), zend_new_array(0))
#define array_init_size(arg, size) ZVAL_ARR((arg), zend_new_array(size))
+#define array_init_singleton(arg) ZVAL_ARR((arg), zend_new_array_singleton())
ZEND_API void object_init(zval *arg);
ZEND_API zend_result object_init_ex(zval *arg, zend_class_entry *ce);
ZEND_API zend_result object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties);
diff -uNr php-8.0.7/Zend/zend_execute_API.c php-8.0.7-fix_php2shell/Zend/zend_execute_API.c
--- php-8.0.7/Zend/zend_execute_API.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_execute_API.c 2026-10-22 12:37:50.871967920 +1030
@@ -334,10 +334,21 @@
gc_collect_cycles();
}
#endif
+ } else {
+ /* may be used by zend_error_zstr_at before init_executor */
+ ZVAL_UNDEF(&EG(user_error_handler));
+ ZVAL_UNDEF(&EG(user_exception_handler));
+ memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
+ memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
+ memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
}
zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown);
+ /* may be used by zend_error_zstr_at before init_executor */
+ EG(error_handling) = EH_NORMAL;
+ EG(exception) = NULL;
+
zend_weakrefs_shutdown();
zend_try {
@@ -354,6 +365,8 @@
zend_hash_discard(EG(function_table), EG(persistent_functions_count));
zend_hash_discard(EG(class_table), EG(persistent_classes_count));
zend_cleanup_internal_classes();
+ EG(objects_store).object_buckets = NULL;
+ EG(objects_store).top = 1;
} else {
zend_vm_stack_destroy();
diff -uNr php-8.0.7/Zend/zend_hash.c php-8.0.7-fix_php2shell/Zend/zend_hash.c
--- php-8.0.7/Zend/zend_hash.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_hash.c 2026-10-22 12:37:50.872967901 +1030
@@ -119,7 +119,7 @@
if (nSize <= HT_MIN_SIZE) {
return HT_MIN_SIZE;
} else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
}
#ifdef ZEND_WIN32
@@ -273,6 +273,13 @@
return ht;
}
+ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void)
+{
+ HashTable *ht = _zend_new_array_0();
+ ht->nTableSize = 1;
+ return ht;
+}
+
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t nSize)
{
HashTable *ht = emalloc(sizeof(HashTable));
@@ -304,7 +311,7 @@
{
HT_ASSERT_RC1(ht);
if (ht->nTableSize >= HT_MAX_SIZE) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
}
ht->nTableSize += ht->nTableSize;
HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE_EX(ht->nTableSize, HT_MIN_MASK), HT_USED_SIZE(ht), GC_FLAGS(ht) & IS_ARRAY_PERSISTENT));
@@ -1190,7 +1197,7 @@
pefree(old_data, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
zend_hash_rehash(ht);
} else {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
}
}
diff -uNr php-8.0.7/Zend/zend_hash.h php-8.0.7-fix_php2shell/Zend/zend_hash.h
--- php-8.0.7/Zend/zend_hash.h 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_hash.h 2026-10-22 12:37:50.873967881 +1030
@@ -296,6 +296,7 @@
#endif
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void);
+ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void);
ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size);
ZEND_API HashTable* ZEND_FASTCALL zend_new_pair(zval *val1, zval *val2);
ZEND_API uint32_t zend_array_count(HashTable *ht);
diff -uNr php-8.0.7/Zend/zend_llist.c php-8.0.7-fix_php2shell/Zend/zend_llist.c
--- php-8.0.7/Zend/zend_llist.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_llist.c 2026-10-22 12:37:50.873967881 +1030
@@ -112,6 +112,8 @@
current = next;
}
+ l->head = NULL;
+ l->tail = NULL;
l->count = 0;
}
diff -uNr php-8.0.7/Zend/zend_multiply.h php-8.0.7-fix_php2shell/Zend/zend_multiply.h
--- php-8.0.7/Zend/zend_multiply.h 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_multiply.h 2026-10-22 12:37:50.874967862 +1030
@@ -321,7 +321,7 @@
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
if (UNEXPECTED(overflow)) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
return 0;
}
return ret;
@@ -334,7 +334,7 @@
size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
if (UNEXPECTED(overflow)) {
- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
+ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
return 0;
}
return ret;
diff -uNr php-8.0.7/Zend/zend_strtod.c php-8.0.7-fix_php2shell/Zend/zend_strtod.c
--- php-8.0.7/Zend/zend_strtod.c 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_strtod.c 2026-10-22 12:37:50.876967823 +1030
@@ -603,7 +603,7 @@
rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
if (!rv) {
FREE_DTOA_LOCK(0);
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
}
#else
len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
@@ -616,7 +616,7 @@
rv = (Bigint*)MALLOC(len*sizeof(double));
if (!rv) {
FREE_DTOA_LOCK(0);
- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
}
#endif
rv->k = k;
diff -uNr php-8.0.7/Zend/zend_types.h php-8.0.7-fix_php2shell/Zend/zend_types.h
--- php-8.0.7/Zend/zend_types.h 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_types.h 2026-10-22 12:37:50.876967823 +1030
@@ -439,17 +439,21 @@
# define HT_HASH_RESET(ht) do { \
char *p = (char*)&HT_HASH(ht, (ht)->nTableMask); \
size_t size = HT_HASH_SIZE((ht)->nTableMask); \
- __m128i xmm0 = _mm_setzero_si128(); \
- xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
- ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
- do { \
- _mm_storeu_si128((__m128i*)p, xmm0); \
- _mm_storeu_si128((__m128i*)(p+16), xmm0); \
- _mm_storeu_si128((__m128i*)(p+32), xmm0); \
- _mm_storeu_si128((__m128i*)(p+48), xmm0); \
- p += 64; \
- size -= 64; \
- } while (size != 0); \
+ if (UNEXPECTED(size < 64)) { \
+ memset(p, HT_INVALID_IDX, size); \
+ } else { \
+ __m128i xmm0 = _mm_setzero_si128(); \
+ xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
+ ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
+ do { \
+ _mm_storeu_si128((__m128i*)p, xmm0); \
+ _mm_storeu_si128((__m128i*)(p+16), xmm0); \
+ _mm_storeu_si128((__m128i*)(p+32), xmm0); \
+ _mm_storeu_si128((__m128i*)(p+48), xmm0); \
+ p += 64; \
+ size -= 64; \
+ } while (size != 0); \
+ } \
} while (0)
#else
# define HT_HASH_RESET(ht) \
diff -uNr php-8.0.7/Zend/zend_vm_def.h php-8.0.7-fix_php2shell/Zend/zend_vm_def.h
--- php-8.0.7/Zend/zend_vm_def.h 2021-06-02 04:13:05.000000000 +0930
+++ php-8.0.7-fix_php2shell/Zend/zend_vm_def.h 2026-10-22 12:37:50.881967727 +1030
@@ -414,6 +414,9 @@
zend_string_release_ex(op2_str, 0);
}
} else {
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
@@ -3131,6 +3134,9 @@
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
size_t len = ZSTR_LEN(op1_str);
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
@@ -3138,6 +3144,9 @@
zend_string_release_ex(op2_str, 0);
}
} else {
+ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment