snuffleupagus/src/sp_utils.c, branch log2fileSecurity module for php7 and php8 - Killing bugclasses and virtual-patching the rest!
http://git.dustri.org/snuffleupagus/atom?h=log2file2025-10-24T21:55:13Zfeat(log): add the possibility to log to a file2025-10-24T21:55:13Zjvoisin2025-10-24T21:50:18Zurn:sha1:6ea4278a512bc9f1f816844222e65a4ea670db8efix(log): systematically drop when .drop() is used2025-10-02T13:22:08Zjvoisin2025-10-02T13:22:08Zurn:sha1:da8c7aebc5602c04b771ada71a098ccb23d83a48
When the `php` logging facility is used, the error could have been caught by
using `set_error_handler` and whatnot. This commit ensures that if the
`.drop()` option is set, we're calling `zend_bailout()` that can't be caught.
An attacker could have used this issue to silently perform some recon of the
running environment. This isn't considered a vulnerability as an attacker
with arbitrary php code execution can simply use the use-after-free of the day
to gain arbitrary (native) code execution anyway, after detecting that
Snuffleupagus is in use, to take little risks of detection.
Rename a handful of global constants2025-10-02T10:16:29Zjvoisin2025-10-02T10:16:29Zurn:sha1:09bc3ffc8734cf2437e14ab123c7b732db53b836Fix a portability issue2024-06-14T17:26:31Zjvoisin2024-06-14T17:26:31Zurn:sha1:b005df282da43a2ba17b38e7da06a69353ea2845
This should fix the following compilation issue:
```
/wrkdirs/usr/ports/security/snuffleupagus/work-php83/snuffleupagus-0.10.0/src/sp_utils.c:438:37: error: too few arguments provided to function-like macro invocation
438 | memcpy(mb_name, ZEND_STRL("mb_"));
| ^
/usr/include/ssp/string.h:117:9: note: macro 'memcpy' defined here
117 | #define memcpy(dst, src, len) __ssp_bos_check3(memcpy, dst, src, len)
```
Declare file local variables and functions static2024-06-06T14:27:31ZChristian Göttsche2024-05-29T18:38:33Zurn:sha1:d82ab8d20191a9ebdb83f918c62fc6c32f068b01
Avoid missing prototype warnings by declaring variables and functions
that are only used in a single file static.
Url encode functions arguments when logging them2023-02-02T12:17:22Zjvoisin2023-02-01T20:12:58Zurn:sha1:2dcf2a2d7578d1e43ee7e3fa69386ccc5afebbf0Fix a possible NULL-byte truncation when outputting parameters in the logs2023-02-01T19:35:23Zjvoisin2023-02-01T19:35:23Zurn:sha1:f4d3c01bd196400548f5712223171007563ab834Add sp.log_max_len2023-01-31T19:25:14Zjvoisin2023-01-31T19:16:21Zurn:sha1:78e451eaf99e8f239867def2d8220dfa348cc167Portability improvements for PHP8.22022-12-09T19:03:22Zjvoisin2022-12-08T20:08:38Zurn:sha1:110daa81c3b11ec102daf4ee634e2f3d2e9c5f36Even more const!2022-07-13T19:25:04Zjvoisin2022-07-13T19:25:04Zurn:sha1:ed87e551efd0160f1944a5e97158ab258db65eaf