Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! http://git.dustri.org/snuffleupagus/atom?h=log2file 2025-10-24T21:55:13Z 2025-10-24T21:55:13Z jvoisin 2025-10-24T21:50:18Z urn:sha1:6ea4278a512bc9f1f816844222e65a4ea670db8e 2025-10-02T10:16:29Z jvoisin 2025-10-02T10:16:29Z urn:sha1:09bc3ffc8734cf2437e14ab123c7b732db53b836 2025-05-13T14:24:50Z jvoisin 2025-05-13T14:24:50Z urn:sha1:847afcae9b6a0570dca96e23d8adf94831a09b4c People are usually well-aware of the outdatedness of the PHP version they're running, which is likely why they're running Snuffleupagus in the first place. This feature shouldn't have been enabled by default, and I fail to see any case where anyone would want to enable it. Moreover, it doesn't take LTS versions from vendors/distributions into account, thus breaking on RHEL/Debian (old)stable. 2024-06-18T19:18:42Z jvoisin 2024-06-18T19:18:42Z urn:sha1:358bd3d82884f24353f6edddf097512b446938b9 No need to use an ulong, an uint is more than enough for our usecases. This fixes the following warning: ``` src/sp_config.c:207:20: runtime error: store to misaligned address 0x796d1f9a78d4 for type 'u_long', which requires 8 byte alignment 0x796d1f9a78d4: note: pointer points here 00 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ #0 0x796d1f92251a in parse_ulong src/sp_config.c:207 #1 0x796d1f9239a9 in sp_process_rule src/sp_config.c:76 #2 0x796d1f92404f in sp_process_config_root src/sp_config.c:31 #3 0x796d1f96770d in sp_config_scan src/sp_config_scanner.c:1482 #4 0x796d1f922cd3 in sp_parse_config src/sp_config.c:62 #5 0x796d1f91e6cf in OnUpdateConfiguration src/snuffleupagus.c:522 #6 0x598aae727646 in zend_register_ini_entries_ex (/usr/bin/php8.2+0x36d646) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #7 0x796d1f91cae1 in zm_startup_snuffleupagus src/snuffleupagus.c:121 #8 0x598aae6b70df in zend_startup_module_ex (/usr/bin/php8.2+0x2fd0df) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #9 0x598aae6b717f (/usr/bin/php8.2+0x2fd17f) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #10 0x598aae6c566a in zend_hash_apply (/usr/bin/php8.2+0x30b66a) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #11 0x598aae64c0b5 in php_module_startup (/usr/bin/php8.2+0x2920b5) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #12 0x598aae4e2265 (/usr/bin/php8.2+0x128265) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) #13 0x796d21b4dc89 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #14 0x796d21b4dd44 in __libc_start_main_impl ../csu/libc-start.c:360 #15 0x598aae4e3550 in _start (/usr/bin/php8.2+0x129550) (BuildId: 5228f916ded87172ddf0f3eca448f1e43874d60f) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/sp_config.c:207:20 in ``` 2024-06-09T15:16:16Z Christian Göttsche 2024-05-27T19:33:00Z urn:sha1:c7ce5c3528e8da8762e6e7067001549e109397ba In addition of the current possibility to filter wrappers by their protocol name, also add the option to filter the "php" wrapper by the requested kind. Especially the 'filter' backend can be disabled that way. 2024-06-06T14:27:35Z Christian Göttsche 2024-05-29T18:38:23Z urn:sha1:f40955e03cd361966f927acfaa477cfceb8930e5 Adjusts casts to void dropping const qualifiers. This helps to avoid mistakes, e.g. modifying string literals. Also use size_t for length, similar to the upstream php interfaces. 2023-01-31T19:25:14Z jvoisin 2023-01-31T19:16:21Z urn:sha1:78e451eaf99e8f239867def2d8220dfa348cc167 2022-12-08T19:55:46Z jvoisin 2022-12-07T20:02:22Z urn:sha1:ccfaf3e4713b1878241f1235a6fcb66ad0582d47 2022-07-12T20:50:28Z Ben Fuhrmannek 2022-04-19T17:01:52Z urn:sha1:cd9031935ef2306f7ba2097856b20bf116f341ee introduced config options: readonly_exec.extended_checks() or xchecks() readonly_exec.no_extended_checks() or noxchecks() 2022-05-03T19:48:35Z jvoisin 2022-05-03T19:48:35Z urn:sha1:7c2d1d7d2713c0fa6bda63c376baf25d9f3d712c