<feed xmlns='http://www.w3.org/2005/Atom'>
<title>snuffleupagus/src/sp_upload_validation.c, branch master</title>
<subtitle>Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! 
</subtitle>
<id>http://git.dustri.org/snuffleupagus/atom?h=master</id>
<link rel='self' href='http://git.dustri.org/snuffleupagus/atom?h=master'/>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/'/>
<updated>2026-04-24T10:14:01Z</updated>
<entry>
<title>Fix an spprintf undefined behaviour</title>
<updated>2026-04-24T10:14:01Z</updated>
<author>
<name>jvoisin</name>
</author>
<published>2026-04-24T10:14:01Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=314b10154495b91eca684124275407b8186bb762'/>
<id>urn:sha1:314b10154495b91eca684124275407b8186bb762</id>
<content type='text'>
`getenv("REMOTE_ADDR")` can return NULL, and it is passed directly to
`spprintf`. While `spprintf` might handle `NULL` gracefully, it's not always
the case.
</content>
</entry>
<entry>
<title>Cast format argument to expected type</title>
<updated>2025-06-25T17:38:39Z</updated>
<author>
<name>Christian Göttsche</name>
</author>
<published>2025-06-25T09:39:44Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=66c711c1b98c0cafa0e4903b862bfbaedd638d7e'/>
<id>urn:sha1:66c711c1b98c0cafa0e4903b862bfbaedd638d7e</id>
<content type='text'>
Please GCC conversion warning:

    src/sp_upload_validation.c: In function 'sp_rfc1867_callback':
    src/sp_utils.h:61:53: warning: format '%lld' expects argument of type 'long long int', but argument 7 has type 'zend_long' {aka 'long int'} [-Wformat=]
       61 |   if (sp_debug_stderr &gt; 0) dprintf(sp_debug_stderr, "[snuffleupagus][DEBUG] %s(): " fmt "\n", __FUNCTION__, ##__VA_ARGS__);
          |                                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    src/sp_upload_validation.c:48:7: note: in expansion of macro 'sp_log_debug'
       48 |       sp_log_debug("Filename: %s\nTmpname: %s\nSize: %zd\nError: %lld\nScript: %s",
          |       ^~~~~~~~~~~~
</content>
</entry>
<entry>
<title>Declare file local variables and functions static</title>
<updated>2024-06-06T14:27:31Z</updated>
<author>
<name>Christian Göttsche</name>
</author>
<published>2024-05-29T18:38:33Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=d82ab8d20191a9ebdb83f918c62fc6c32f068b01'/>
<id>urn:sha1:d82ab8d20191a9ebdb83f918c62fc6c32f068b01</id>
<content type='text'>
Avoid missing prototype warnings by declaring variables and functions
that are only used in a single file static.
</content>
</entry>
<entry>
<title>removed confusung newlines for better reading/searching</title>
<updated>2021-12-20T16:58:23Z</updated>
<author>
<name>Ben Fuhrmannek</name>
</author>
<published>2021-12-20T16:58:23Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=f24151869a54a95da28b74beac5f1f87c06cfafe'/>
<id>urn:sha1:f24151869a54a95da28b74beac5f1f87c06cfafe</id>
<content type='text'>
</content>
</entry>
<entry>
<title>config is stack allocated now + some code improvements (see details)</title>
<updated>2021-09-23T10:23:40Z</updated>
<author>
<name>Ben Fuhrmannek</name>
</author>
<published>2021-09-23T10:23:40Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=54c352c1b5aa08b187dd1e52e544709cad2b0fee'/>
<id>urn:sha1:54c352c1b5aa08b187dd1e52e544709cad2b0fee</id>
<content type='text'>
* for easier memory manegement, the entire sp_config struct was merged into snuffleupagus_globals and allocated on stack where possible
* SNUFFLEUPAGUS_G() can be written as SPG(), which is faster to type and easier to read
* execution_depth is re-initialized to 0 for each request
* function calls with inline string and length parameters consistently use ZEND_STRL instead of sizeof()-1
* execution is actually hooked if recursion protection is enabled
* some line breaks were removed to make the code more readable
</content>
</entry>
<entry>
<title>fixed compiler warning</title>
<updated>2021-08-07T20:31:55Z</updated>
<author>
<name>Ben Fuhrmannek</name>
</author>
<published>2021-08-07T20:31:55Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=51c020904f25ac7400e4db2e5174edc8c49fcb43'/>
<id>urn:sha1:51c020904f25ac7400e4db2e5174edc8c49fcb43</id>
<content type='text'>
</content>
</entry>
<entry>
<title>Add some checks to prevent recursion upon config reloading</title>
<updated>2021-05-09T20:32:46Z</updated>
<author>
<name>jvoisin</name>
</author>
<published>2021-05-09T20:32:20Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=c3115fc26daebd0fa7135c202154272e42fbfcfd'/>
<id>urn:sha1:c3115fc26daebd0fa7135c202154272e42fbfcfd</id>
<content type='text'>
</content>
</entry>
<entry>
<title>Allow empty configuration (#342)</title>
<updated>2020-08-12T08:48:59Z</updated>
<author>
<name>jvoisin</name>
</author>
<published>2020-08-12T08:48:59Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=a0d21a189cf04bb963dce93dcbd0bd9694584a0b'/>
<id>urn:sha1:a0d21a189cf04bb963dce93dcbd0bd9694584a0b</id>
<content type='text'>
This commit allows php to run (with a warning) if there
is no specified snuffleupagus configuration,
instead of refusing to start.</content>
</entry>
<entry>
<title>refactoring sp_log_* (#340)</title>
<updated>2020-07-22T07:28:42Z</updated>
<author>
<name>Giovanni</name>
</author>
<published>2020-07-22T07:28:42Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=e8d3cd9b26f0b4d660e424f2657f11bbc01eb171'/>
<id>urn:sha1:e8d3cd9b26f0b4d660e424f2657f11bbc01eb171</id>
<content type='text'>
Co-authored-by: Giovanni Dante Grazioli &lt;giovanni.dantegrazioli@nbs-system.com&gt;</content>
</entry>
<entry>
<title>%s/nbs-system/jvoisin</title>
<updated>2020-03-04T18:30:42Z</updated>
<author>
<name>jvoisin</name>
</author>
<published>2020-03-04T18:30:42Z</published>
<link rel='alternate' type='text/html' href='http://git.dustri.org/snuffleupagus/commit/?id=d7b7a0d4e10d7b87b124889821b14e9858ed0a9c'/>
<id>urn:sha1:d7b7a0d4e10d7b87b124889821b14e9858ed0a9c</id>
<content type='text'>
Since I'm the only one to maintain Snuffleupagus,
let's adjust the links and contact addresses
of my fork, to point to well… my fork.
</content>
</entry>
</feed>
