summaryrefslogtreecommitdiff
path: root/hardening-patch-4.4.2-0.4.15.patch
diff options
context:
space:
mode:
authorjvoisin2018-09-11 10:30:39 +0200
committerjvoisin2018-09-11 10:30:39 +0200
commit5321e0fcf6ab6e6cc5d95b4cbd9bc0f7e44e01fe (patch)
tree25ce8c8ffe0880fe8c7aedde6df1c6d0a80c6d37 /hardening-patch-4.4.2-0.4.15.patch
first commit
Diffstat (limited to 'hardening-patch-4.4.2-0.4.15.patch')
-rw-r--r--hardening-patch-4.4.2-0.4.15.patch9419
1 files changed, 9419 insertions, 0 deletions
diff --git a/hardening-patch-4.4.2-0.4.15.patch b/hardening-patch-4.4.2-0.4.15.patch
new file mode 100644
index 0000000..206dcfa
--- /dev/null
+++ b/hardening-patch-4.4.2-0.4.15.patch
@@ -0,0 +1,9419 @@
1diff -Nura php-4.4.2/Changelog.hphp hardening-patch-4.4.2-0.4.15/Changelog.hphp
2--- php-4.4.2/Changelog.hphp 1970-01-01 01:00:00.000000000 +0100
3+++ hardening-patch-4.4.2-0.4.15/Changelog.hphp 2006-09-07 19:33:12.000000000 +0200
4@@ -0,0 +1,61 @@
5+Changelog of the Hardening-Patch
6+--------------------------------
7+
8+0.4.15 - 07. September 2006
9+
10+ PHP4:
11+ [+] Fix for potential DOS in handling of include blacklists
12+
13+ PHP4+5:
14+ [+] Backported a fix for open_basedir problems with insanse PHP scripts
15+ [+] Added a fix for ini_restore() PHP security vulnerability
16+
17+0.4.14 - 11. August 2006
18+
19+ PHP4:
20+ [+] Remove unecessary call to AC_BROKEN_REALPATH
21+
22+ PHP5:
23+ [+] Fix Remote URL Include Protection - Thanks to: Bart Vanbrabant
24+
25+ PHP4+5:
26+ [+] Added a few PHP security fixes / see changelog.secfix for details
27+ [+] Fixed the memory_limit protection for systems with different perdir memory_limits
28+ [+] Fixed a possible memory corruption when foreach() is used with wrong arguments
29+
30+0.4.13 - 07. August 2006
31+
32+ PHP4+5:
33+ [+] Added a fix for a compile problem on solaris due to missing strcasestr()
34+
35+0.4.12 - 19. July 2006
36+
37+ PHP4:
38+ [+] Added fixes from sf4 security patch / see changelog.secfix for details
39+
40+ PHP5:
41+ [+] Added fixes from sf5 security patch / see changelog.secfix for details
42+
43+ PHP4+5:
44+ [+] Added anti mail spam feature
45+ [+] Speedup of zend_hash canary (clear/destroy)
46+ [+] Added a fix for a DOS in the handling of URL blacklists
47+
48+0.4.11 - 13. May 2006
49+
50+ PHP5:
51+ [+] tsrm_virtual_cwd.c: close open_basedir, safe_mode hole introduced by realpath() cache
52+ [+] install-pear-nozlib.phar: bundle in full package download of 5.1.4
53+
54+ PHP4+5:
55+ [+] tsrm_virtual_cwd.c: realpath() hotfix to solve problems with non existing directories
56+
57+
58+0.4.10 - 11. May 2006
59+
60+ PHP4:
61+ [+] info.c: backport from 5.1.4 contained TSRMLS macro that had to be removed
62+
63+ PHP4+5:
64+ [+] fopen_wrappers.c: fix for a trailing slash problem with open_basedir
65+
66diff -Nura php-4.4.2/Changelog.secfix hardening-patch-4.4.2-0.4.15/Changelog.secfix
67--- php-4.4.2/Changelog.secfix 1970-01-01 01:00:00.000000000 +0100
68+++ hardening-patch-4.4.2-0.4.15/Changelog.secfix 2006-09-05 20:30:33.000000000 +0200
69@@ -0,0 +1,38 @@
70+Changelog of PHP 4.4.2 Security Fixes
71+
72+Release 5 - 11. August 2006
73+
74+ [+] Added IMAP open_basedir/safe_mode check
75+ [+] Added a upstream fix for previous ext/session fixes
76+ [+] Added upstream fix to ext/socket
77+ [+] Added sscanf() security fix
78+ [+] Added fixes for handling of corrupt .gif files to gdlib
79+
80+Release 4 - 13. July 2006
81+
82+ [+] Added recursive array printing fix to phpinfo() XSS fix
83+
84+Release 3 - 08. July 2006
85+
86+ [+] Added a fix for an overflow in the bundled libmysql on win32 systems
87+ [+] Added a fix for overlong tempfilename
88+ [+] Added multiple fixes for new safe_mode/open_basedir problems in ext/curl
89+ [+] Added a fix for an integer overflow in str_repeat()
90+ [+] Added a variable initialisation in stream factory code
91+ [+] Added a fix for crashbugs in http_fopen_wrapper
92+ [+] Added a fix for the error_log() safe_mode/open_basedir vulnerability
93+ [+] Added a *working* wordwrap() fix
94+ [+] Added code to make memory_limit work on 64bit systems
95+ [+] Added bufferoverflow and high character fix to ext/wddx
96+
97+Release 2 - 10. May 2006
98+
99+ [+] Added a fix for the serious zend_hash_del() vulnerability
100+ [+] Added a fix for another ext/curl open_basedir/safe_mode bypass vulnerability
101+ [+] Added a wordwrap() bufferoverflow fix
102+ [+] Added a phpinfo() XSS fix
103+ [+] Added html_entity_decode() binary safety fix
104+ [+] Added safe_mode/open_basedir fixes to tempnam() and copy()
105+ [+] Added check for invalid characters in session identifiers to ext/session
106+ [+] Added a fix for a double file unlink in ext/session
107+
108diff -Nura php-4.4.2/configure hardening-patch-4.4.2-0.4.15/configure
109--- php-4.4.2/configure 2006-01-12 19:24:23.000000000 +0100
110+++ hardening-patch-4.4.2-0.4.15/configure 2006-09-05 20:30:33.000000000 +0200
111@@ -402,6 +402,16 @@
112 ac_default_prefix=/usr/local
113 # Any additions from configure.in:
114 ac_help="$ac_help
115+ --disable-hardening-patch-mm-protect Disable the Memory Manager protection."
116+ac_help="$ac_help
117+ --disable-hardening-patch-ll-protect Disable the Linked List protection."
118+ac_help="$ac_help
119+ --disable-hardening-patch-inc-protect Disable include/require protection."
120+ac_help="$ac_help
121+ --disable-hardening-patch-fmt-protect Disable format string protection."
122+ac_help="$ac_help
123+ --disable-hardening-patch-hash-protect Disable Zend HashTable DTOR protection."
124+ac_help="$ac_help
125
126 SAPI modules:
127 "
128@@ -854,6 +864,8 @@
129 ac_help="$ac_help
130 --disable-tokenizer Disable tokenizer support"
131 ac_help="$ac_help
132+ --disable-varfilter Disable Hardening-Patch's variable filter"
133+ac_help="$ac_help
134 --enable-wddx Enable WDDX support."
135 ac_help="$ac_help
136 --disable-xml Disable XML support using bundled expat lib"
137@@ -2942,6 +2954,157 @@
138
139
140
141+# Check whether --enable-hardening-patch-mm-protect or --disable-hardening-patch-mm-protect was given.
142+if test "${enable_hardening_patch_mm_protect+set}" = set; then
143+ enableval="$enable_hardening_patch_mm_protect"
144+
145+ DO_HARDENING_PATCH_MM_PROTECT=$enableval
146+
147+else
148+
149+ DO_HARDENING_PATCH_MM_PROTECT=yes
150+
151+fi
152+
153+
154+# Check whether --enable-hardening-patch-ll-protect or --disable-hardening-patch-ll-protect was given.
155+if test "${enable_hardening_patch_ll_protect+set}" = set; then
156+ enableval="$enable_hardening_patch_ll_protect"
157+
158+ DO_HARDENING_PATCH_LL_PROTECT=$enableval
159+
160+else
161+
162+ DO_HARDENING_PATCH_LL_PROTECT=yes
163+
164+fi
165+
166+
167+# Check whether --enable-hardening-patch-inc-protect or --disable-hardening-patch-inc-protect was given.
168+if test "${enable_hardening_patch_inc_protect+set}" = set; then
169+ enableval="$enable_hardening_patch_inc_protect"
170+
171+ DO_HARDENING_PATCH_INC_PROTECT=$enableval
172+
173+else
174+
175+ DO_HARDENING_PATCH_INC_PROTECT=yes
176+
177+fi
178+
179+
180+# Check whether --enable-hardening-patch-fmt-protect or --disable-hardening-patch-fmt-protect was given.
181+if test "${enable_hardening_patch_fmt_protect+set}" = set; then
182+ enableval="$enable_hardening_patch_fmt_protect"
183+
184+ DO_HARDENING_PATCH_FMT_PROTECT=$enableval
185+
186+else
187+
188+ DO_HARDENING_PATCH_FMT_PROTECT=yes
189+
190+fi
191+
192+
193+# Check whether --enable-hardening-patch-hash-protect or --disable-hardening-patch-hash-protect was given.
194+if test "${enable_hardening_patch_hash_protect+set}" = set; then
195+ enableval="$enable_hardening_patch_hash_protect"
196+
197+ DO_HARDENING_PATCH_HASH_PROTECT=$enableval
198+
199+else
200+
201+ DO_HARDENING_PATCH_HASH_PROTECT=yes
202+
203+fi
204+
205+
206+echo $ac_n "checking whether to protect the Zend Memory Manager""... $ac_c" 1>&6
207+echo "configure:2725: checking whether to protect the Zend Memory Manager" >&5
208+echo "$ac_t""$DO_HARDENING_PATCH_MM_PROTECT" 1>&6
209+
210+echo $ac_n "checking whether to protect the Zend Linked Lists""... $ac_c" 1>&6
211+echo "configure:2729: checking whether to protect the Zend Linked Lists" >&5
212+echo "$ac_t""$DO_HARDENING_PATCH_LL_PROTECT" 1>&6
213+
214+echo $ac_n "checking whether to protect include/require statements""... $ac_c" 1>&6
215+echo "configure:2733: checking whether to protect include/require statements" >&5
216+echo "$ac_t""$DO_HARDENING_PATCH_INC_PROTECT" 1>&6
217+
218+echo $ac_n "checking whether to protect PHP Format String functions""... $ac_c" 1>&6
219+echo "configure:2737: checking whether to protect PHP Format String functions" >&5
220+echo "$ac_t""$DO_HARDENING_PATCH_FMT_PROTECT" 1>&6
221+
222+echo $ac_n "checking whether to protect the Zend HashTable Destructors""... $ac_c" 1>&6
223+echo "configure:2737: checking whether to protect the Zend HashTable Destructors" >&5
224+echo "$ac_t""$DO_HARDENING_PATCH_HASH_PROTECT" 1>&6
225+
226+
227+cat >> confdefs.h <<\EOF
228+#define HARDENING_PATCH 1
229+EOF
230+
231+
232+
233+if test "$DO_HARDENING_PATCH_MM_PROTECT" = "yes"; then
234+ cat >> confdefs.h <<\EOF
235+#define HARDENING_PATCH_MM_PROTECT 1
236+EOF
237+
238+else
239+ cat >> confdefs.h <<\EOF
240+#define HARDENING_PATCH_MM_PROTECT 0
241+EOF
242+
243+fi
244+
245+if test "$DO_HARDENING_PATCH_LL_PROTECT" = "yes"; then
246+ cat >> confdefs.h <<\EOF
247+#define HARDENING_PATCH_LL_PROTECT 1
248+EOF
249+
250+else
251+ cat >> confdefs.h <<\EOF
252+#define HARDENING_PATCH_LL_PROTECT 0
253+EOF
254+
255+fi
256+
257+if test "$DO_HARDENING_PATCH_INC_PROTECT" = "yes"; then
258+ cat >> confdefs.h <<\EOF
259+#define HARDENING_PATCH_INC_PROTECT 1
260+EOF
261+
262+else
263+ cat >> confdefs.h <<\EOF
264+#define HARDENING_PATCH_INC_PROTECT 0
265+EOF
266+
267+fi
268+
269+if test "$DO_HARDENING_PATCH_FMT_PROTECT" = "yes"; then
270+ cat >> confdefs.h <<\EOF
271+#define HARDENING_PATCH_FMT_PROTECT 1
272+EOF
273+
274+else
275+ cat >> confdefs.h <<\EOF
276+#define HARDENING_PATCH_FMT_PROTECT 0
277+EOF
278+
279+fi
280+
281+if test "$DO_HARDENING_PATCH_HASH_PROTECT" = "yes"; then
282+ cat >> confdefs.h <<\EOF
283+#define HARDENING_PATCH_HASH_PROTECT 1
284+EOF
285+
286+else
287+ cat >> confdefs.h <<\EOF
288+#define HARDENING_PATCH_HASH_PROTECT 0
289+EOF
290+
291+fi
292
293
294
295@@ -16017,6 +16180,62 @@
296 fi
297
298
299+ echo $ac_n "checking whether realpath is broken""... $ac_c" 1>&6
300+echo "configure:14928: checking whether realpath is broken" >&5
301+if eval "test \"`echo '$''{'ac_cv_broken_realpath'+set}'`\" = set"; then
302+ echo $ac_n "(cached) $ac_c" 1>&6
303+else
304+
305+ if test "$cross_compiling" = yes; then
306+
307+ ac_cv_broken_realpath=no
308+
309+else
310+ cat > conftest.$ac_ext <<EOF
311+#line 14939 "configure"
312+#include "confdefs.h"
313+
314+main() {
315+ char buf[4096+1];
316+ buf[0] = 0;
317+ realpath("/etc/hosts/../passwd", buf);
318+ exit(strcmp(buf, "/etc/passwd")==0);
319+}
320+
321+EOF
322+if { (eval echo configure:14958: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
323+then
324+
325+ ac_cv_broken_realpath=no
326+
327+else
328+ echo "configure: failed program was:" >&5
329+ cat conftest.$ac_ext >&5
330+ rm -fr conftest*
331+
332+ ac_cv_broken_realpath=yes
333+
334+fi
335+rm -fr conftest*
336+fi
337+
338+
339+fi
340+
341+echo "$ac_t""$ac_cv_broken_realpath" 1>&6
342+ if test "$ac_cv_broken_realpath" = "yes"; then
343+ cat >> confdefs.h <<\EOF
344+#define PHP_BROKEN_REALPATH 1
345+EOF
346+
347+ else
348+ cat >> confdefs.h <<\EOF
349+#define PHP_BROKEN_REALPATH 0
350+EOF
351+
352+ fi
353+
354+
355 echo $ac_n "checking for declared timezone""... $ac_c" 1>&6
356 echo "configure:16022: checking for declared timezone" >&5
357 if eval "test \"`echo '$''{'ac_cv_declared_timezone'+set}'`\" = set"; then
358@@ -86718,7 +86937,7 @@
359 if test "$ac_cv_crypt_blowfish" = "yes"; then
360 ac_result=1
361 else
362- ac_result=0
363+ ac_result=1
364 fi
365 cat >> confdefs.h <<EOF
366 #define PHP_BLOWFISH_CRYPT $ac_result
367@@ -87420,7 +87639,7 @@
368 url_scanner.c var.c versioning.c assert.c strnatcmp.c levenshtein.c \
369 incomplete_class.c url_scanner_ex.c ftp_fopen_wrapper.c \
370 http_fopen_wrapper.c php_fopen_wrapper.c credits.c css.c \
371- var_unserializer.c ftok.c aggregation.c sha1.c ; do
372+ var_unserializer.c ftok.c aggregation.c sha1.c sha256.c crypt_blowfish.c ; do
373
374 IFS=.
375 set $ac_src
376@@ -87475,7 +87694,7 @@
377 url_scanner.c var.c versioning.c assert.c strnatcmp.c levenshtein.c \
378 incomplete_class.c url_scanner_ex.c ftp_fopen_wrapper.c \
379 http_fopen_wrapper.c php_fopen_wrapper.c credits.c css.c \
380- var_unserializer.c ftok.c aggregation.c sha1.c ; do
381+ var_unserializer.c ftok.c aggregation.c sha1.c sha256.c crypt_blowfish.c ; do
382
383 IFS=.
384 set $ac_src
385@@ -87601,7 +87820,7 @@
386 url_scanner.c var.c versioning.c assert.c strnatcmp.c levenshtein.c \
387 incomplete_class.c url_scanner_ex.c ftp_fopen_wrapper.c \
388 http_fopen_wrapper.c php_fopen_wrapper.c credits.c css.c \
389- var_unserializer.c ftok.c aggregation.c sha1.c ; do
390+ var_unserializer.c ftok.c aggregation.c sha1.c sha256.c crypt_blowfish.c ; do
391
392 IFS=.
393 set $ac_src
394@@ -87653,7 +87872,7 @@
395 url_scanner.c var.c versioning.c assert.c strnatcmp.c levenshtein.c \
396 incomplete_class.c url_scanner_ex.c ftp_fopen_wrapper.c \
397 http_fopen_wrapper.c php_fopen_wrapper.c credits.c css.c \
398- var_unserializer.c ftok.c aggregation.c sha1.c ; do
399+ var_unserializer.c ftok.c aggregation.c sha1.c sha256.c crypt_blowfish.c ; do
400
401 IFS=.
402 set $ac_src
403@@ -91124,6 +91343,265 @@
404 fi
405
406
407+echo $ac_n "checking whether to enable Hardening-Patch's variable filter""... $ac_c" 1>&6
408+echo "configure:82041: checking whether to enable Hardening-Patch's variable filter" >&5
409+# Check whether --enable-varfilter or --disable-varfilter was given.
410+if test "${enable_varfilter+set}" = set; then
411+ enableval="$enable_varfilter"
412+ PHP_VARFILTER=$enableval
413+else
414+
415+ PHP_VARFILTER=yes
416+
417+ if test "$PHP_ENABLE_ALL" && test "yes" = "yes"; then
418+ PHP_VARFILTER=$PHP_ENABLE_ALL
419+ fi
420+
421+fi
422+
423+
424+
425+ext_output="yes, shared"
426+ext_shared=yes
427+case $PHP_VARFILTER in
428+shared,*)
429+ PHP_VARFILTER=`echo "$PHP_VARFILTER"|sed 's/^shared,//'`
430+ ;;
431+shared)
432+ PHP_VARFILTER=yes
433+ ;;
434+no)
435+ ext_output=no
436+ ext_shared=no
437+ ;;
438+*)
439+ ext_output=yes
440+ ext_shared=no
441+ ;;
442+esac
443+
444+
445+
446+echo "$ac_t""$ext_output" 1>&6
447+
448+
449+
450+
451+if test "$PHP_VARFILTER" != "no"; then
452+ cat >> confdefs.h <<\EOF
453+#define HAVE_VARFILTER 1
454+EOF
455+
456+
457+ ext_builddir=ext/varfilter
458+ ext_srcdir=$abs_srcdir/ext/varfilter
459+
460+ ac_extra=
461+
462+ if test "$ext_shared" != "shared" && test "$ext_shared" != "yes" && test "" != "cli"; then
463+
464+
465+
466+ case ext/varfilter in
467+ "") ac_srcdir="$abs_srcdir/"; unset ac_bdir; ac_inc="-I. -I$abs_srcdir" ;;
468+ /*) ac_srcdir=`echo "ext/varfilter"|cut -c 2-`"/"; ac_bdir=$ac_srcdir; ac_inc="-I$ac_bdir -I$abs_srcdir/$ac_bdir" ;;
469+ *) ac_srcdir="$abs_srcdir/ext/varfilter/"; ac_bdir="ext/varfilter/"; ac_inc="-I$ac_bdir -I$ac_srcdir" ;;
470+ esac
471+
472+
473+
474+ b_c_pre=$php_c_pre
475+ b_cxx_pre=$php_cxx_pre
476+ b_c_meta=$php_c_meta
477+ b_cxx_meta=$php_cxx_meta
478+ b_c_post=$php_c_post
479+ b_cxx_post=$php_cxx_post
480+ b_lo=$php_lo
481+
482+
483+ old_IFS=$IFS
484+ for ac_src in varfilter.c; do
485+
486+ IFS=.
487+ set $ac_src
488+ ac_obj=$1
489+ IFS=$old_IFS
490+
491+ PHP_GLOBAL_OBJS="$PHP_GLOBAL_OBJS $ac_bdir$ac_obj.lo"
492+
493+ case $ac_src in
494+ *.c) ac_comp="$b_c_pre $ac_extra $ac_inc $b_c_meta -c $ac_srcdir$ac_src -o $ac_bdir$ac_obj.$b_lo $b_c_post" ;;
495+ *.cpp) ac_comp="$b_cxx_pre $ac_extra $ac_inc $b_cxx_meta -c $ac_srcdir$ac_src -o $ac_bdir$ac_obj.$b_lo $b_cxx_post" ;;
496+ esac
497+
498+ cat >>Makefile.objects<<EOF
499+$ac_bdir$ac_obj.lo: $ac_srcdir$ac_src
500+ $ac_comp
501+EOF
502+ done
503+
504+
505+ EXT_STATIC="$EXT_STATIC varfilter"
506+ if test "$ext_shared" != "nocli"; then
507+ EXT_CLI_STATIC="$EXT_CLI_STATIC varfilter"
508+ fi
509+ else
510+ if test "$ext_shared" = "shared" || test "$ext_shared" = "yes"; then
511+
512+ case ext/varfilter in
513+ "") ac_srcdir="$abs_srcdir/"; unset ac_bdir; ac_inc="-I. -I$abs_srcdir" ;;
514+ /*) ac_srcdir=`echo "ext/varfilter"|cut -c 2-`"/"; ac_bdir=$ac_srcdir; ac_inc="-I$ac_bdir -I$abs_srcdir/$ac_bdir" ;;
515+ *) ac_srcdir="$abs_srcdir/ext/varfilter/"; ac_bdir="ext/varfilter/"; ac_inc="-I$ac_bdir -I$ac_srcdir" ;;
516+ esac
517+
518+
519+
520+ b_c_pre=$shared_c_pre
521+ b_cxx_pre=$shared_cxx_pre
522+ b_c_meta=$shared_c_meta
523+ b_cxx_meta=$shared_cxx_meta
524+ b_c_post=$shared_c_post
525+ b_cxx_post=$shared_cxx_post
526+ b_lo=$shared_lo
527+
528+
529+ old_IFS=$IFS
530+ for ac_src in varfilter.c; do
531+
532+ IFS=.
533+ set $ac_src
534+ ac_obj=$1
535+ IFS=$old_IFS
536+
537+ shared_objects_varfilter="$shared_objects_varfilter $ac_bdir$ac_obj.lo"
538+
539+ case $ac_src in
540+ *.c) ac_comp="$b_c_pre $ac_extra $ac_inc $b_c_meta -c $ac_srcdir$ac_src -o $ac_bdir$ac_obj.$b_lo $b_c_post" ;;
541+ *.cpp) ac_comp="$b_cxx_pre $ac_extra $ac_inc $b_cxx_meta -c $ac_srcdir$ac_src -o $ac_bdir$ac_obj.$b_lo $b_cxx_post" ;;
542+ esac
543+
544+ cat >>Makefile.objects<<EOF
545+$ac_bdir$ac_obj.lo: $ac_srcdir$ac_src
546+ $ac_comp
547+EOF
548+ done
549+
550+
551+ install_modules="install-modules"
552+ PHP_MODULES="$PHP_MODULES \$(phplibdir)/varfilter.la"
553+
554+ PHP_VAR_SUBST="$PHP_VAR_SUBST shared_objects_varfilter"
555+
556+ cat >>Makefile.objects<<EOF
557+\$(phplibdir)/varfilter.la: $ext_builddir/varfilter.la
558+ \$(LIBTOOL) --mode=install cp $ext_builddir/varfilter.la \$(phplibdir)
559+
560+$ext_builddir/varfilter.la: \$(shared_objects_varfilter) \$(VARFILTER_SHARED_DEPENDENCIES)
561+ \$(LIBTOOL) --mode=link \$(CC) \$(COMMON_FLAGS) \$(CFLAGS_CLEAN) \$(EXTRA_CFLAGS) \$(LDFLAGS) -o \$@ -export-dynamic -avoid-version -prefer-pic -module -rpath \$(phplibdir) \$(EXTRA_LDFLAGS) \$(shared_objects_varfilter) \$(VARFILTER_SHARED_LIBADD)
562+
563+EOF
564+
565+ cat >> confdefs.h <<EOF
566+#define COMPILE_DL_VARFILTER 1
567+EOF
568+
569+ fi
570+ fi
571+
572+ if test "$ext_shared" != "shared" && test "$ext_shared" != "yes" && test "" = "cli"; then
573+ if test "$PHP_SAPI" = "cgi"; then
574+
575+
576+ case ext/varfilter in
577+ "") ac_srcdir="$abs_srcdir/"; unset ac_bdir; ac_inc="-I. -I$abs_srcdir" ;;
578+ /*) ac_srcdir=`echo "ext/varfilter"|cut -c 2-`"/"; ac_bdir=$ac_srcdir; ac_inc="-I$ac_bdir -I$abs_srcdir/$ac_bdir" ;;
579+ *) ac_srcdir="$abs_srcdir/ext/varfilter/"; ac_bdir="ext/varfilter/"; ac_inc="-I$ac_bdir -I$ac_srcdir" ;;
580+ esac
581+
582+
583+
584+ b_c_pre=$php_c_pre
585+ b_cxx_pre=$php_cxx_pre
586+ b_c_meta=$php_c_meta
587+ b_cxx_meta=$php_cxx_meta
588+ b_c_post=$php_c_post
589+ b_cxx_post=$php_cxx_post
590+ b_lo=$php_lo
591+
592+
593+ old_IFS=$IFS
594+ for ac_src in varfilter.c; do
595+
596+ IFS=.
597+ set $ac_src
598+ ac_obj=$1
599+ IFS=$old_IFS
600+
601+ PHP_GLOBAL_OBJS="$PHP_GLOBAL_OBJS $ac_bdir$ac_obj.lo"
602+
603+ case $ac_src in
604+ *.c) ac_comp="$b_c_pre $ac_extra $ac_inc $b_c_meta -c $ac_srcdir$ac_src -o $ac_bdir$ac_obj.$b_lo $b_c_post" ;;
605+ *.cpp) ac_comp="$b_cxx_pre $ac_extra $ac_inc $b_cxx_meta -c $ac_srcdir$ac_src -o $ac_bdir$ac_obj.$b_lo $b_cxx_post" ;;
606+ esac
607+
608+ cat >>Makefile.objects<<EOF
609+$ac_bdir$ac_obj.lo: $ac_srcdir$ac_src
610+ $ac_comp
611+EOF
612+ done
613+
614+
615+ EXT_STATIC="$EXT_STATIC varfilter"
616+ else
617+
618+
619+ case ext/varfilter in
620+ "") ac_srcdir="$abs_srcdir/"; unset ac_bdir; ac_inc="-I. -I$abs_srcdir" ;;
621+ /*) ac_srcdir=`echo "ext/varfilter"|cut -c 2-`"/"; ac_bdir=$ac_srcdir; ac_inc="-I$ac_bdir -I$abs_srcdir/$ac_bdir" ;;
622+ *) ac_srcdir="$abs_srcdir/ext/varfilter/"; ac_bdir="ext/varfilter/"; ac_inc="-I$ac_bdir -I$ac_srcdir" ;;
623+ esac
624+
625+
626+
627+ b_c_pre=$php_c_pre
628+ b_cxx_pre=$php_cxx_pre
629+ b_c_meta=$php_c_meta
630+ b_cxx_meta=$php_cxx_meta
631+ b_c_post=$php_c_post
632+ b_cxx_post=$php_cxx_post
633+ b_lo=$php_lo
634+
635+
636+ old_IFS=$IFS
637+ for ac_src in varfilter.c; do
638+
639+ IFS=.
640+ set $ac_src
641+ ac_obj=$1
642+ IFS=$old_IFS
643+
644+ PHP_CLI_OBJS="$PHP_CLI_OBJS $ac_bdir$ac_obj.lo"
645+
646+ case $ac_src in
647+ *.c) ac_comp="$b_c_pre $ac_extra $ac_inc $b_c_meta -c $ac_srcdir$ac_src -o $ac_bdir$ac_obj.$b_lo $b_c_post" ;;
648+ *.cpp) ac_comp="$b_cxx_pre $ac_extra $ac_inc $b_cxx_meta -c $ac_srcdir$ac_src -o $ac_bdir$ac_obj.$b_lo $b_cxx_post" ;;
649+ esac
650+
651+ cat >>Makefile.objects<<EOF
652+$ac_bdir$ac_obj.lo: $ac_srcdir$ac_src
653+ $ac_comp
654+EOF
655+ done
656+
657+
658+ fi
659+ EXT_CLI_STATIC="$EXT_CLI_STATIC varfilter"
660+ fi
661+
662+ BUILD_DIR="$BUILD_DIR $ext_builddir"
663+
664+
665+fi
666
667
668 echo $ac_n "checking whether to enable WDDX support""... $ac_c" 1>&6
669@@ -104088,7 +104566,7 @@
670 php_ini.c SAPI.c rfc1867.c php_content_types.c strlcpy.c \
671 strlcat.c mergesort.c reentrancy.c php_variables.c php_ticks.c \
672 streams.c network.c php_open_temporary_file.c php_logos.c \
673- output.c memory_streams.c user_streams.c; do
674+ output.c memory_streams.c user_streams.c hardening_patch.c; do
675
676 IFS=.
677 set $ac_src
678@@ -104273,7 +104751,7 @@
679 zend_opcode.c zend_operators.c zend_ptr_stack.c zend_stack.c \
680 zend_variables.c zend.c zend_API.c zend_extensions.c zend_hash.c \
681 zend_list.c zend_indent.c zend_builtin_functions.c zend_sprintf.c \
682- zend_ini.c zend_qsort.c zend_multibyte.c zend_strtod.c; do
683+ zend_ini.c zend_qsort.c zend_multibyte.c zend_strtod.c zend_canary.c; do
684
685 IFS=.
686 set $ac_src
687diff -Nura php-4.4.2/configure.in hardening-patch-4.4.2-0.4.15/configure.in
688--- php-4.4.2/configure.in 2006-01-12 18:52:29.000000000 +0100
689+++ hardening-patch-4.4.2-0.4.15/configure.in 2006-09-05 20:30:33.000000000 +0200
690@@ -247,7 +247,7 @@
691 sinclude(Zend/acinclude.m4)
692 sinclude(Zend/Zend.m4)
693 sinclude(TSRM/tsrm.m4)
694-
695+sinclude(main/hardening_patch.m4)
696
697
698 divert(2)
699@@ -621,6 +621,7 @@
700 AC_FUNC_ALLOCA
701 dnl PHP_AC_BROKEN_SPRINTF
702 dnl PHP_AC_BROKEN_SNPRINTF
703+dnl PHP_AC_BROKEN_REALPATH
704 PHP_DECLARED_TIMEZONE
705 PHP_TIME_R_TYPE
706 PHP_READDIR_R_TYPE
707@@ -1260,7 +1261,7 @@
708 php_ini.c SAPI.c rfc1867.c php_content_types.c strlcpy.c \
709 strlcat.c mergesort.c reentrancy.c php_variables.c php_ticks.c \
710 streams.c network.c php_open_temporary_file.c php_logos.c \
711- output.c memory_streams.c user_streams.c)
712+ output.c memory_streams.c user_streams.c hardening_patch.c)
713 PHP_ADD_SOURCES(/main, internal_functions.c,, sapi)
714 case $host_alias in
715 *netware*)
716@@ -1281,7 +1282,7 @@
717 zend_opcode.c zend_operators.c zend_ptr_stack.c zend_stack.c \
718 zend_variables.c zend.c zend_API.c zend_extensions.c zend_hash.c \
719 zend_list.c zend_indent.c zend_builtin_functions.c zend_sprintf.c \
720- zend_ini.c zend_qsort.c zend_multibyte.c zend_strtod.c)
721+ zend_ini.c zend_qsort.c zend_multibyte.c zend_strtod.c zend_canary.c )
722
723 if test -r "$abs_srcdir/Zend/zend_objects.c"; then
724 PHP_ADD_SOURCES(Zend, zend_objects.c zend_object_handlers.c zend_objects_API.c zend_mm.c)
725diff -Nura php-4.4.2/ext/curl/curl.c hardening-patch-4.4.2-0.4.15/ext/curl/curl.c
726--- php-4.4.2/ext/curl/curl.c 2006-01-05 19:03:18.000000000 +0100
727+++ hardening-patch-4.4.2-0.4.15/ext/curl/curl.c 2006-09-05 20:30:33.000000000 +0200
728@@ -87,6 +87,7 @@
729 #define SMART_STR_PREALLOC 4096
730
731 #include "ext/standard/php_smart_str.h"
732+#include "ext/standard/php_string.h"
733 #include "ext/standard/info.h"
734 #include "ext/standard/file.h"
735 #include "ext/standard/url.h"
736@@ -111,7 +112,7 @@
737
738 #define PHP_CURL_CHECK_OPEN_BASEDIR(str, len) \
739 if (((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) && \
740- strncasecmp(str, "file://", sizeof("file://") - 1) == 0) \
741+ strncasecmp(str, "file:", sizeof("file:") - 1) == 0) \
742 { \
743 php_url *tmp_url; \
744 \
745@@ -119,6 +120,11 @@
746 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid url '%s'", str); \
747 RETURN_FALSE; \
748 } \
749+ \
750+ if (php_memnstr(str, tmp_url->path, strlen(tmp_url->path), str + len)) { \
751+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Url '%s' contains unencoded control characters.", str); \
752+ RETURN_FALSE; \
753+ } \
754 \
755 if (tmp_url->query || tmp_url->fragment || php_check_open_basedir(tmp_url->path TSRMLS_CC) || \
756 (PG(safe_mode) && !php_checkuid(tmp_url->path, "rb+", CHECKUID_CHECK_MODE_PARAM)) \
757@@ -839,7 +845,6 @@
758 case CURLOPT_FTPLISTONLY:
759 case CURLOPT_FTPAPPEND:
760 case CURLOPT_NETRC:
761- case CURLOPT_FOLLOWLOCATION:
762 case CURLOPT_PUT:
763 #if CURLOPT_MUTE != 0
764 case CURLOPT_MUTE:
765@@ -876,6 +881,16 @@
766 convert_to_long_ex(zvalue);
767 error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
768 break;
769+ case CURLOPT_FOLLOWLOCATION:
770+ convert_to_long_ex(zvalue);
771+ if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) {
772+ if (Z_LVAL_PP(zvalue) != 0) {
773+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "CURLOPT_FOLLOWLOCATION cannot be activated when in safe_mode or an open_basedir is set");
774+ RETURN_FALSE;
775+ }
776+ }
777+ error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
778+ break;
779 case CURLOPT_URL:
780 case CURLOPT_PROXY:
781 case CURLOPT_USERPWD:
782diff -Nura php-4.4.2/ext/curl/curlstreams.c hardening-patch-4.4.2-0.4.15/ext/curl/curlstreams.c
783--- php-4.4.2/ext/curl/curlstreams.c 2006-01-01 14:46:50.000000000 +0100
784+++ hardening-patch-4.4.2-0.4.15/ext/curl/curlstreams.c 2006-09-05 20:30:33.000000000 +0200
785@@ -297,7 +297,11 @@
786 curl_easy_setopt(curlstream->curl, CURLOPT_WRITEHEADER, stream);
787
788 /* currently buggy (bug is in curl) */
789- curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 1);
790+ if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) {
791+ curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 0);
792+ } else {
793+ curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 1);
794+ }
795
796 curl_easy_setopt(curlstream->curl, CURLOPT_ERRORBUFFER, curlstream->errstr);
797 curl_easy_setopt(curlstream->curl, CURLOPT_VERBOSE, 0);
798diff -Nura php-4.4.2/ext/fbsql/php_fbsql.c hardening-patch-4.4.2-0.4.15/ext/fbsql/php_fbsql.c
799--- php-4.4.2/ext/fbsql/php_fbsql.c 2006-01-01 14:46:52.000000000 +0100
800+++ hardening-patch-4.4.2-0.4.15/ext/fbsql/php_fbsql.c 2006-09-05 20:30:33.000000000 +0200
801@@ -1797,8 +1797,24 @@
802 }
803 else if (fbcmdErrorsFound(md))
804 {
805+#if HARDENING_PATCH
806+ char* query_copy;
807+ int i;
808+#endif
809 FBCErrorMetaData* emd = fbcdcErrorMetaData(c, md);
810 char* emg = fbcemdAllErrorMessages(emd);
811+#if HARDENING_PATCH
812+ query_copy=estrdup(query_copy);
813+ for (i=0; query_copy[i]; i++) if (query_copy[i]<32) query_copy[i]='.';
814+ php_security_log(S_SQL, "fbsql error: %s - query: %s", emg, query_copy);
815+ efree(query_copy);
816+ if (HG(hphp_sql_bailout_on_error)) {
817+ free(emg);
818+ fbcemdRelease(emd);
819+ result = 0;
820+ zend_bailout();
821+ }
822+#endif
823 if (FB_SQL_G(generateWarnings))
824 {
825 if (emg)
826diff -Nura php-4.4.2/ext/gd/libgd/gd_gif_in.c hardening-patch-4.4.2-0.4.15/ext/gd/libgd/gd_gif_in.c
827--- php-4.4.2/ext/gd/libgd/gd_gif_in.c 2005-09-25 14:13:49.000000000 +0200
828+++ hardening-patch-4.4.2-0.4.15/ext/gd/libgd/gd_gif_in.c 2006-09-05 20:30:33.000000000 +0200
829@@ -212,6 +212,12 @@
830 if (!im) {
831 return 0;
832 }
833+
834+ if (!im->colorsTotal) {
835+ gdImageDestroy(im);
836+ return 0;
837+ }
838+
839 /* Check for open colors at the end, so
840 we can reduce colorsTotal and ultimately
841 BitsPerPixel */
842@@ -502,6 +508,19 @@
843 int v;
844 int xpos = 0, ypos = 0, pass = 0;
845 int i;
846+
847+ /*
848+ ** Initialize the Compression routines
849+ */
850+ if (! ReadOK(fd,&c,1)) {
851+ return;
852+ }
853+
854+ if (c > MAX_LWZ_BITS) {
855+ return;
856+ }
857+
858+
859 /* Stash the color map into the image */
860 for (i=0; (i<gdMaxColors); i++) {
861 im->red[i] = cmap[CM_RED][i];
862@@ -511,12 +530,7 @@
863 }
864 /* Many (perhaps most) of these colors will remain marked open. */
865 im->colorsTotal = gdMaxColors;
866- /*
867- ** Initialize the Compression routines
868- */
869- if (! ReadOK(fd,&c,1)) {
870- return;
871- }
872+
873 if (LWZReadByte(fd, TRUE, c) < 0) {
874 return;
875 }
876diff -Nura php-4.4.2/ext/gd/tests/bug38112.gif hardening-patch-4.4.2-0.4.15/ext/gd/tests/bug38112.gif
877--- php-4.4.2/ext/gd/tests/bug38112.gif 1970-01-01 01:00:00.000000000 +0100
878+++ hardening-patch-4.4.2-0.4.15/ext/gd/tests/bug38112.gif 2006-09-05 20:30:33.000000000 +0200
879@@ -0,0 +1,140 @@
880+GIF89a‚
881+ CEcKMk‡‹¸SUmŽ‘µ˜š¶hiu€"A3}‚±“˜Å;<E¤¥® &RF!(Z17bCF[JMc‡‹«KM] 4!&FŸ¤Â„†“xz…®°¼]i¥ˆ–Ü_fŠBEU©°ÑRUeVW\ôõú$,L;Ce6=\17R=C[8=S{~‹FGKæçë 69Fs '@$+EMUtW`FLc©×ovŽ )MTkEK^.r=,4K=CTU]sw]am139•¤ÔÙ踻ÄÐÑÔ4'5Y,3ELSdEKZ'K  $86B^3;M&*3U\l?Mh\dtÁÆÐ]_c:X)ESl«½ß·ÆàÇÑã %3KEKU<CMLS]hp|=K^%3E-;L7GZ3ARpx‚ESbN[jT\e„Œ• ‘–›Ýâçfhjêíð×ÚÝMZf>KV6=C%=O*>N.BR,:EKbp6JVq·Õ~«¹–š›ïóô(Òæ ‡““#%%@CC†ŠŠ’––öûûúþþóööòúøvzv’–’˜šþþúXVHtsm›š•nmi–•‘bR.æâÚ•ƒf¤ž•‹yd<4,„y»µ¯ÇÅÃ{zy2'sfZž’‡ÞÓÊ®¦ XTQc]Z}mg&{vu•Šˆ‹††þúúuttþþþúúú–––†††ÿÿÿ!ÿ NETSCAPE2.0
882+ CEcKMk‡‹¸SUmŽ‘µ˜š¶hiu€"A3}‚±“˜Å;<E¤¥® &RF!(Z17bCF[JMc‡‹«KM] 4!&FŸ¤Â„†“xz…®°¼]i¥ˆ–Ü_fŠBEU©°ÑRUeVW\ôõú$,L;Ce6=\17R=C[8=S{~‹FGKæçë 69Fs '@$+EMUtW`FLc©×ovŽ )MTkEK^.r=,4K=CTU]sw]am139•¤ÔÙ踻ÄÐÑÔ4'5Y,3ELSdEKZ'K  $86B^3;M&*3U\l?Mh\dtÁÆÐ]_c:X)ESl«½ß·ÆàÇÑã %3KEKU<CMLS]hp|=K^%3E-;L7GZ3ARpx‚ESbN[jT\e„Œ• ‘–›Ýâçfhjêíð×ÚÝMZf>KV6=C%=O*>N.BR,:EKbp6JVq·Õ~«¹–š›ïóô(Òæ ‡““#%%@CC†ŠŠ’––öûûúþþóööòúøvzv’–’˜šþþúXVHtsm›š•nmi–•‘bR.æâÚ•ƒf¤ž•‹yd<4,„y»µ¯ÇÅÃ{zy2'sfZž’‡ÞÓÊ®¦ XTQc]Z}mg&{vu•Šˆ‹††þúúuttþþþúúú–––†††ÿÿÿÿŒ©ËÍû¡‰qÝ]ïès¿†âH6Uà¡É~ý¡–»ÿðîF7•úÎ÷JšèýÒØ»Ì|[¿Ärú¦Ôê¢ÚüE–wЫÿ*4;çïW(´ÆºjÎ
883+“¬ùÈ–Ö¨ƒ_Ë×ÎxëÖšhyvVyë”xc-%Ba­â×kç(¨XÉÆö˜FÆ(½­äìÉÙyèvÛâä¹ï™‹ aÝë¸Ï‘@‰æHÛÙœøZk«¨hÚŠ'ÝMªåé °Í)Zùk[ùÖÒâ0K¡«ëÑÝíŒÂ\Gø%êÔy,l [6%F¼Ðà2Å >Ǿ…“UIŸ?6N¨ƒòîÀ>Mÿhîغ…CŒ¥J„
884+ÔJªmÚ¶iI’eÊ‘%~­!T‰"2¶ZU
885+禅^Ú@ë¥â¢-ÌBAYÊV©Y›Ü0âÅKTÊFÏX¹Ls†‘…)râ§R+0l-¹BãV%’âUråÃœ Jmy@ƒÌÒ-QYÅàŦ©mŒµ¼œ1%ΤO¥jvr3hm!1`0WêD©ÜJµj­%‚ÐTÚð¨o4­½QéÉ™%)0 *â‚Æ‹%LüÔTt9s­WKäÈ™#‡‰˜D›(QšÑ§ÓÜ_•NG‘ƒ¡PHx#{
886+1ŒHe{™¥„"Ë¥Z\¾UúÓ+M²fÑÿü#HP„B„
887+ª¨BÇ}ð1wV¡$øã.è˜[zsüÕJ'²Ì
888+@pÅ&±$² €èx …ø±Ùd¸Æ\ݵ@HÜy§øD5æýéC…ÜòŠ*sY‚¨„²Ž:æøÎ
889+ÿ a‡u¢c%l‰!F!¢Z­ŽÅЪrÎ9BýÜÉž<L0 $odˆëX¬âF!| A%tt°À<ÞHƒ‹Ì
890+!ž‰ñE³ÿÀÒG}A‡³pký)ŠlˆˆÄžzZÉYân,A~ûð*Ÿ·nYÂÇ( ׌Çƨ‡*°Ð1‡&rÈéÆ\gûÅ…¬bÉ*¡T²S%Ð~Z‰P©•Ë}ÇDÐÃhðÀk´;`»¯ôñB½¡õA¯kF.g- ¿²G!¯X‚íõ–à`‰ D¯›ÈD+Öô8P¸A\Üã˜À0
891+";_Þõ†BÈÄeIƒ-œàµ‚ŠZ8A6 ÀMgv
892+eÂ!È0/Jÿðál¡!@štÏuìAø€ÐCj< ˆ Ð
893+ñ`G¥*
894+’p"T–Ufö ·%¯ÿ–o,Ù
895+¤:>=#^db¥Î ˆ©"V¼xq?eê·+ﶓNC¯H€KØ
896+Üôl"ö°?¬a ‚@A°€…OK*æ¸G:ôÁˆK!œÆŽÍÆŠ'‹8HøB‹]íÀ×)¶ÆžD´?
897+.h¼$"y>¸9 E§û·«.cMÂü«[F/×W ÷b×®WƤmÀ3Æ3ž5 üP»sžsPé(ßÄ TH©;áîcœ©æÞyQr Ä'`1dS(m({fýÏýr¢K MeÆ„Èí éD°šê <¸b÷|lÀ]½ xOzÒséÅÐUHmŒÿü—¼äˆÈ~Éû0K—t›
898+-pwn¾§I4öU u##fàl@¤ ³À
899+K×oa×oͲ¦—ØGù—W±ç0ÕqHG Å H`w•^™·€Dcç5
900+hF_Ec2wƒK"Rà‰ÀƒÙg ìæ\oÇ— yÀ“}MV®°
901+t@ˆ D°‹€2€h`Hÿoñ¦l_bÜ€öð ð}@šb10…±0 Ã`ˆˆH |^]µCZ¶ `¸S“Ø 
902+ƒ ò%  P,’Òl Œ 8 ¿Ôœ€
903+¤@
904+qG
905+Ñ@|0 #]}P‹·˜‹»ç|s[\ø‹f‰a¨!pŇ€TAœ T@œPZ°àW˜ƒÉf{¤Gˆ` ° 
906+ˆ 
907+±
908+ÚÀ‹>à:ý ”¿× s¿%’Åx ‚ø0Ùÿç”' …3cSyˆp•'™
909+évYÐÖaéoð78”ý yšd”0’LÙá zäû·B-I qàz=C™
910+)0‰3ÆÀf\ÙªÀ„@–çâ@Œé˜½™ À–¸"o9 з l臙
911+) „'þô:©IÔ
912+œ`TNyS°x™£
913+W)<bŸÿšã—<ƒET0P­ÇX$_|ЈààÙ1â©‘©I2g> e
914+£=ß5
915+¨ç"¨8kC©¢¨fʨ1àf 9, zð©NZ!¤jBó©XD¬¦UQZ&ÀžÚ¤nx1o0^j'«jpþ”
916+™@«°P„.`“jF`©+`®æÚz=sªëZ¡JÊ|ëê|ð¬v‚
917+±ë*póz›Ðº;à;0  ´øÿÊ=þÙ
918+é!Ç ! 9­7‡0E@,P [+¶æJ40®&0±& ¶+
919+¶_ë¸çÊ& ¹I¨³ p»»rÛx
920+ä«3ðÀzP @Š0o°оî;º÷¿wµd° ° !`»*0˜€¸:³{«·Z³’ê³F°³¿Q¾z€ÃLÁ
921+.° 4`»û¿E
922+8\üÀE€¤ ¼oÀ?¼ÁBÜÁøêÁ‰ƒåS
923+ €E æë
924+wÀÇxÐ ¶pˆ
925+Šà
926+®@ ‡Œà8<9ŒÃzpÆ<Ü
927+æ Á@Ìn< Ó
928+3œ ¹&àcP
929+®PÈ´À®°ÈŒ Ë
930+²¼Ê
931+QÐ ~” ¬˜
932+32#Èæ%Þë°
933+cࡤ
934+àû³\0À- ½€¦ ß¡]ß=žðÜPÿ à)€Î^àúàÝÍƶ=â-.á»».À ]x 
935+¦Pöpõ Ôù€ƒ(à©@å¤Pu
936+‡çèÿ0ïÀlï êxþ@í@
937+X úmâ©
938+^ÛÄqP鸪Epák
939+æÐŒŸ†à g’)€ :
940+McŒó5Ÿ aŸ ΀ l0xð á>ÿ ?æÙ ôOVG¿ñ¨ c<^°>ðN` ›-@ð `_¢R
941+UiðDìbübŸ
942+¢° Њ¼Ðùáðö¡/÷\múbô’ T ÷]0#UÐ(aÉ0
943+¨Ì
944+„Ä$RD ÷"µäH«;˜ÏÐlºéª³Ž‡Ì8×
945+<Š‹-dC!¯½âsˆ½ á† œQ3.‘?Èœ!…‰Zq.3è¤0£FërÈñHøé¦AÂfŽ™á ¹à"Ã5òj·ø°@>>Ȩ§NÜBÅ!sñ7þ›Q@ ¼î,~ÀG o‚cÈC\pá‡CŠÀð†'¬ £/ÁÛ%_"¤RLDñvDBÎK7
946+7ÞŠ‚ã·S°m#ƒH¸ªÂOIü˜CŒ]y¥‘º3ÌØåRcor†KXO„$ÕškD¼ó +zk#øäË€œ.ÎÉ‚"´ 7×]ÿ{tL)þ[ÐG-Š…w -8E¨^ÆÛ‚‹t@!½0Ò#Å‘¬d ùȉ#a"!"‰$¨ðC7ÐÒéþ …ÁŒ5îB f†¤—…N’ uÔ&P~¢ 4 ex|ñ%”ÃÚ+ÖƒNEì[¨"WŽ[(–øçéhAL‹væè9T0‚…»‹¸°¼§ŸPaÏG#,?·ÿ~¹ r&ƒ,Ra$\2Ñ™ç
947+özs-Sêq™Øb!äÐ… ½–IÒÃ,?±Ã[:¢Cóæ.½`nÀ¡ˆ`à æ@ b@Ϙ¡Àž6JiJyÎ38¡€Äº7XæÍØt¤ \‘KÿS â´†+ÈЇKðA›PEäp”P,s{¾ñ =³eO|^¨š°¼¦"²i†;¸BÂJ#A9˜}TchXÄ1q‰x€ŠD$þ‚JŠno{§ˆDðé‚K\ÂI2BQõ 
948+?”Bf -,6?”VS§‘@/B…5ü=V@Ãor
949+¸œŽu™m€D ö0 %^‚ vsžáÏ;DˆRjºa k ±ª¸F/vŠS´>Ü“/XÁŒ5?M+ èH#lá¨pHá
950+Hhî¤wu 3;X+
951+,%+
952+ðR‚  ë…#ôà |Ä»ÂRRK-,¤Ê.@8’Ks7HPp hœÚLÀ/C ;ñ|SÏ,Á  \¢J†Î@©Ö^Ô0‚ =QCÇ&³5/1V„vD @
953+ã„âÏ=Ð0ó=ßÄãŽG¸‘¿~Â˳‚ÿ"J±d¸[
954+Ä¥'Là¬O~:唑 eðBiˆA,Ε¾?¸aK€a
955+Ø=4—XY6“1ž’£¤†½yŠ&,á oHT™
956+ÒÀÕ®.pã“?§yÐg¨ñ‡cÆ,n
957+@LbÁPÜ+™À„‹2aÿU<²@Λál•«Íxé:ÖA
958+@
959+Y”L-¢0m–ÀsrÓ&ò
960+bôÜàg?Ó(Žº;ãîæ0‡ žñ n$êR§z6ärzË"1\ßA&ЃL×¼ | ²ÀÍÎGd¨¼¼P8ñ
961+ív¼°2ôe¦Æ%¢ ~Ñu€À+seÍÖ„|Xaô
962+W
963+0ΧA§çwe|wˆ<DŠø\‡Ö Éÿr”±†?ø€à+pWƒdN?V‡‡8yX|£Sp—TIç€*Pâà Q–wÒÇwÂxÊ0xóVÅ pQ ¼àƒ„n
964+h`EË`•ˆ„|%|5Bpx8eÀfÊH^åÏè„ 
965+ËU
966+`PÔ Ù
967+`u§ÕðX¡‡w
968+ ºð™´š<ðM•Q©—øéÝÅŸÔY[Ö‰i°
969+ð›@
970+ë` $
971+„Pʉ òJ¯nà>Š#‰Rª¥zªcPýj?ƒZ“ ` ZúVÿàp×i
972+ã0˳œ´û°Žœ›w7 ¿û ñ³ÁEÀÇ]Êx•»“VP&œÊfÌÊa
973+0 t̆ý°Z¡¢@1]‰Œˆ ÀÕé„Óó[Ñ}K} †ü@½
974+€iìÑný¸Â`Š*¬'ÝÀË` (gñeWÝf`ˆ’0ØÉëÎûÖËŒº@Ïgí
975+« ù€uWÙáê͘ˆ‘Ê ÓP˜,œx-
976+Æ€Æ
977+$p
978+o FO°4±
979+´ üÝß­°4Èà³qÝ©­ÕÚíÅݽ¼‰­µã-4åMè00¹p
980+,Ðk¯á¯à ©p
981+žà ‚ð© ¡
982+ƒ
983+ÿÝ
984+
985+0 Ïð ¥€xÁ´ Í °PJÃðNH*ÿPÙt qÑ
986+ðèÈ0Ý€æj>Ø\ÍÚ­ u çóÜî
987+Ž@ ˜à劮 ŒÞ_Œ^ 6Ž]i~ÝžÌÇò;¿`œŽÑíp Î,
988+R° j° Ÿð Ýþ ›0^¬ð h€4ƒ
989+y°
990+ÉÀ@
991+›ÿþïÄÐþn%°ÙÀ ÉÀé˜ ÿ훀Rð H°š@8¥°¿À L
992+Ê
993+%PÊð ‹ðí[° k ¿„ã
994+BLÀ±ŒÐS? ^xø¡!
995+dPžã_]é0ÏïO%Udð£ƒöõpÉp
996+j°ñP€ú‹P&¬à÷ À y 
997+QßËàYˆï…¼ 
998+L0Š°õ¿ßõx]- _•ÏQd =½ºŸÊÀ
999+!
1000+ÆJ.«3rÏ Tɲ̘4É F'OŸH Fl”©S¨¾y¸ä@¹`ÁÒ­ShŒ,W¸,¹‚õDYDB¨`9úIÓ4F§Z™8[vÿìK)WÖi³ïÌIaŠ C„pbâÅ‘2mçî[ÔÇYÆÙ›g«7¿’±1& yȸúE6TPcÅ´bÝ)öíñ1*I^ÜŠ\îžù;°ðž´Œÿp˜kÚ ç›z³ ÎéFœgÌyXt t
1001+fˆ¢ 5>á‚ÄqÆa|ùe‹ @B
1002+)Ö¸cšK\øc pÅÚj=øE 9¬(b‡–øšiÕá|õGtcU×)=m8c‡æYc†ºÈÁ>ù¤?Ø°d
1003+$\>¸PKr€eP& 4¬5ºWLÐ!v(ûÿ`êx?0®6Wä‘ë,¹À=Qfˆy
1004+¡wB
1005+ÉaŠM61 $¶¢`.ÑÃŽH`©¥äH烌 øØàv
1006+‰›L~£8 >ÊfÅ?å¸#  …ÆúÁ{8hD#ì€d|ˆ„%"Á¹;Xâ‚C«B0~€ üÀŠ Ä…1*Ül,…5깊ð‡ÆP†ºà_løYX¡yà¡rÀ*pÂz™à'ö
1007+X„@&°¢mÈXà0€v·»—èŒ`”à ‡gFâÜIrŠ;FÀ‡#$ày<D›çº
1008+T¸Cô0ËYfA‰—° ¼0rV¼Á¾ €H²%{¹ä%u2Æ2r2@ºø$‘lèøÿc6àár ²ÁY[ˆB8ù$tátl¤+h ^úò—?ø@"ª ©!™5²nbR„LÂЙơ†,t1 P& ³°&6 X6Ü´,õ*À°ðEç|1T¡DHEúƒAØ€VøCãpI}ê“Ÿ/DÆ?*P†#®8®¹… œ­{DÄ"!ÁH¸"ÞóžÁŠŽöa"…jIÝ …?Hm~`Ô'o&ÁÏHÈô?(ÜaSœêÔ<5ìÇ<â€
1009+YX…$ʺâ q%ú
1010+¯ ;9"
1011+¨@E;÷_Àâ´˜pB.œ0d"¿!Š ÿoë°RÂÆOÀ¨Ânß+â+†¦ÁM1¡\sœk¨k˜*ÑGظsÈ®‡€‰7äâ oÄœðf2 9¥öÜA–ŒÏ/è¹
1012+6xo9¨\墘ر(Vñ#¬Ðå€ÆÕ b=`!-sý` X$x͹h D½9¿ v–í’óü…<ÇaU€„B
1013+^DÍ=>-.à
1014+Qz K(ëä=/y°UHÐñ“MÚZ(†>^ŠÛÁ‚<hó€c`|3o®!nP ˜Û 6.p®jÿà \bÐöb„8Wãfy¶Dñ^sÆÐhIJÚm/Ë» š®+¦À,WN·¹Ï8Áî O| ŠøCJ=×!wVðB+€‚¡Š#ÅЇN±Æ­ ý~YÓ9°Ä¦-`4+QÆ›†ö€á–{‚êVwÃËcŽLÐ|/äEÏsñãWèZ°G  o)Tw‰t¤Âì°Òž¹\Ø´iN;7¸ánèDßÝ`†%$¼èE/ͱ /¸w
1015+H }[Á)œBÍbƒê«>"ò¿G0*tÀP„‡CE°§8hƒQ¨9xÿZ(Z¨µ#
1016+~H†[ÀYК¢2xÂÓØ`P?À;
1017+ÂP…eZ£…V
1018+‰XQP… ²ƒŽŒ‚Þ³‚*HJdÊ?!¨´r(†‰¤ÉÈ©qãDŠ˜² ø ¥ˆeü‰8\…n
1019+
1020\ Kein Zeilenumbruch am Dateiende.
1021diff -Nura php-4.4.2/ext/gd/tests/bug38112.phpt hardening-patch-4.4.2-0.4.15/ext/gd/tests/bug38112.phpt
1022--- php-4.4.2/ext/gd/tests/bug38112.phpt 1970-01-01 01:00:00.000000000 +0100
1023+++ hardening-patch-4.4.2-0.4.15/ext/gd/tests/bug38112.phpt 2006-09-05 20:30:33.000000000 +0200
1024@@ -0,0 +1,17 @@
1025+--TEST--
1026+Bug #38112 (GIF Invalid Code size ).
1027+--SKIPIF--
1028+<?php
1029+ if (!extension_loaded('gd')) {
1030+ die("skip gd extension not available\n");
1031+ }
1032+ if (!GD_BUNDLED) {
1033+ die('skip external GD libraries may fail');
1034+ }
1035+?>
1036+--FILE--
1037+<?php
1038+$im = imagecreatefromgif(dirname(__FILE__) . '/bug38112.gif');
1039+?>
1040+--EXPECTF--
1041+Warning: imagecreatefromgif() [%s]: '%sbug38112.gif' is not a valid GIF file in %sbug38112.php on line %d
1042diff -Nura php-4.4.2/ext/imap/php_imap.c hardening-patch-4.4.2-0.4.15/ext/imap/php_imap.c
1043--- php-4.4.2/ext/imap/php_imap.c 2006-01-05 01:50:19.000000000 +0100
1044+++ hardening-patch-4.4.2-0.4.15/ext/imap/php_imap.c 2006-09-05 20:30:33.000000000 +0200
1045@@ -26,7 +26,7 @@
1046 | PHP 4.0 updates: Zeev Suraski <zeev@zend.com> |
1047 +----------------------------------------------------------------------+
1048 */
1049-/* $Id: php_imap.c,v 1.142.2.44.2.4 2006/01/05 00:50:19 iliaa Exp $ */
1050+/* $Id: php_imap.c,v 1.142.2.44.2.5 2006/08/04 20:32:44 iliaa Exp $ */
1051
1052 #define IMAP41
1053
1054@@ -731,6 +731,13 @@
1055 efree(IMAPG(imap_password));
1056 }
1057
1058+ /* local filename, need to perform open_basedir and safe_mode checks */
1059+ if (Z_STRVAL_PP(mailbox)[0] != '{' &&
1060+ (php_check_open_basedir(Z_STRVAL_PP(mailbox) TSRMLS_CC) ||
1061+ (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(mailbox), NULL, CHECKUID_CHECK_FILE_AND_DIR)))) {
1062+ RETURN_FALSE;
1063+ }
1064+
1065 IMAPG(imap_user) = estrndup(Z_STRVAL_PP(user), Z_STRLEN_PP(user));
1066 IMAPG(imap_password) = estrndup(Z_STRVAL_PP(passwd), Z_STRLEN_PP(passwd));
1067
1068diff -Nura php-4.4.2/ext/mbstring/mbstring.c hardening-patch-4.4.2-0.4.15/ext/mbstring/mbstring.c
1069--- php-4.4.2/ext/mbstring/mbstring.c 2006-01-01 14:46:54.000000000 +0100
1070+++ hardening-patch-4.4.2-0.4.15/ext/mbstring/mbstring.c 2006-09-05 20:30:33.000000000 +0200
1071@@ -1488,6 +1488,7 @@
1072 char *strtok_buf = NULL, **val_list;
1073 zval *array_ptr = (zval *) arg;
1074 int n, num, val_len, *len_list;
1075+ unsigned int new_val_len;
1076 enum mbfl_no_encoding from_encoding;
1077 mbfl_string string, resvar, resval;
1078 mbfl_encoding_detector *identd = NULL;
1079@@ -1610,8 +1611,14 @@
1080 val_len = len_list[n];
1081 }
1082 n++;
1083- /* add variable to symbol table */
1084- php_register_variable_safe(var, val, val_len, array_ptr TSRMLS_CC);
1085+ /* we need val to be emalloc()ed */
1086+ val = estrndup(val, val_len);
1087+ if (sapi_module.input_filter(info->data_type, var, &val, val_len, &new_val_len TSRMLS_CC)) {
1088+ /* add variable to symbol table */
1089+ php_register_variable_safe(var, val, new_val_len, array_ptr TSRMLS_CC);
1090+ }
1091+ efree(val);
1092+
1093 if (convd != NULL){
1094 mbfl_string_clear(&resvar);
1095 mbfl_string_clear(&resval);
1096diff -Nura php-4.4.2/ext/mysql/libmysql/libmysql.c hardening-patch-4.4.2-0.4.15/ext/mysql/libmysql/libmysql.c
1097--- php-4.4.2/ext/mysql/libmysql/libmysql.c 2003-07-28 09:28:55.000000000 +0200
1098+++ hardening-patch-4.4.2-0.4.15/ext/mysql/libmysql/libmysql.c 2006-09-05 20:30:33.000000000 +0200
1099@@ -213,6 +213,10 @@
1100 if (!host || !strcmp(host,LOCAL_HOST))
1101 host=LOCAL_HOST_NAMEDPIPE;
1102
1103+ if (sizeof(szPipeName) <= (strlen(host) + strlen(unix_socket) + sizeof("\\\\\\pipe\\"))) {
1104+ return INVALID_HANDLE_VALUE;
1105+ }
1106+
1107 sprintf( szPipeName, "\\\\%s\\pipe\\%s", host, unix_socket);
1108 DBUG_PRINT("info",("Server name: '%s'. Named Pipe: %s",
1109 host, unix_socket));
1110diff -Nura php-4.4.2/ext/mysql/php_mysql.c hardening-patch-4.4.2-0.4.15/ext/mysql/php_mysql.c
1111--- php-4.4.2/ext/mysql/php_mysql.c 2006-01-01 14:46:55.000000000 +0100
1112+++ hardening-patch-4.4.2-0.4.15/ext/mysql/php_mysql.c 2006-09-05 20:30:33.000000000 +0200
1113@@ -1218,6 +1218,8 @@
1114 {
1115 php_mysql_conn *mysql;
1116 MYSQL_RES *mysql_result;
1117+ char *copy_query;
1118+ int i;
1119
1120 ZEND_FETCH_RESOURCE2(mysql, php_mysql_conn *, mysql_link, link_id, "MySQL-Link", le_link, le_plink);
1121
1122@@ -1268,6 +1270,13 @@
1123 php_error_docref("http://www.mysql.com/doc" TSRMLS_CC, E_WARNING, "%s", mysql_error(&mysql->conn));
1124 }
1125 }
1126+ copy_query = estrdup(Z_STRVAL_PP(query));
1127+ for (i=0; copy_query[i]; i++) if (copy_query[i] < 32) copy_query[i]='.';
1128+ php_security_log(S_SQL, "MySQL error: %s - query: %s", mysql_error(&mysql->conn), copy_query);
1129+ efree(copy_query);
1130+ if (HG(hphp_sql_bailout_on_error)) {
1131+ zend_bailout();
1132+ }
1133 RETURN_FALSE;
1134 }
1135 #else
1136@@ -1275,12 +1284,20 @@
1137 /* check possible error */
1138 if (MySG(trace_mode)){
1139 if (mysql_errno(&mysql->conn)){
1140- php_error_docref("http://www.mysql.com/doc" TSRMLS_CC, E_WARNING, mysql_error(&mysql->conn));
1141+ php_error_docref("http://www.mysql.com/doc" TSRMLS_CC, E_WARNING, "%s", mysql_error(&mysql->conn));
1142 }
1143 }
1144+ copy_query = estrdup(Z_STRVAL_PP(query));
1145+ for (i=0; copy_query[i]; i++) if (copy_query[i] < 32) copy_query[i]='.';
1146+ php_security_log(S_SQL, "MySQL error: %s - query: %s", mysql_error(&mysql->conn), copy_query);
1147+ efree(copy_query);
1148+ if (HG(hphp_sql_bailout_on_error)) {
1149+ zend_bailout();
1150+ }
1151 RETURN_FALSE;
1152 }
1153 #endif
1154+
1155 if(use_store == MYSQL_USE_RESULT) {
1156 mysql_result=mysql_use_result(&mysql->conn);
1157 } else {
1158diff -Nura php-4.4.2/ext/pgsql/pgsql.c hardening-patch-4.4.2-0.4.15/ext/pgsql/pgsql.c
1159--- php-4.4.2/ext/pgsql/pgsql.c 2006-01-01 14:46:56.000000000 +0100
1160+++ hardening-patch-4.4.2-0.4.15/ext/pgsql/pgsql.c 2006-09-05 20:30:33.000000000 +0200
1161@@ -1001,10 +1001,28 @@
1162 case PGRES_EMPTY_QUERY:
1163 case PGRES_BAD_RESPONSE:
1164 case PGRES_NONFATAL_ERROR:
1165- case PGRES_FATAL_ERROR:
1166- PHP_PQ_ERROR("Query failed: %s", pgsql);
1167- PQclear(pgsql_result);
1168- RETURN_FALSE;
1169+ case PGRES_FATAL_ERROR:
1170+ {
1171+#if HARDENING_PATCH
1172+ int i;
1173+ char *query_copy;
1174+#endif
1175+ char *msgbuf = _php_pgsql_trim_message(PQerrorMessage(pgsql), NULL);
1176+ PQclear(pgsql_result);
1177+#if HARDENING_PATCH
1178+ query_copy = estrdup(Z_STRVAL_PP(query));
1179+ for (i=0; query_copy[i]; i++) if (query_copy[i]<32) query_copy[i]='.';
1180+ php_security_log(S_SQL, "PgSQL error: %s - query: %s", msgbuf, query_copy);
1181+ efree(query_copy);
1182+ if (HG(hphp_sql_bailout_on_error)) {
1183+ efree(msgbuf);
1184+ zend_bailout();
1185+ }
1186+#endif
1187+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Query failed: %s", msgbuf);
1188+ efree(msgbuf);
1189+ RETURN_FALSE;
1190+ }
1191 break;
1192 case PGRES_COMMAND_OK: /* successful command that did not return rows */
1193 default:
1194diff -Nura php-4.4.2/ext/session/mod_files.c hardening-patch-4.4.2-0.4.15/ext/session/mod_files.c
1195--- php-4.4.2/ext/session/mod_files.c 2006-01-01 14:46:56.000000000 +0100
1196+++ hardening-patch-4.4.2-0.4.15/ext/session/mod_files.c 2006-09-05 20:30:33.000000000 +0200
1197@@ -16,7 +16,7 @@
1198 +----------------------------------------------------------------------+
1199 */
1200
1201-/* $Id: mod_files.c,v 1.83.2.9.2.2 2006/01/01 13:46:56 sniper Exp $ */
1202+/* $Id: mod_files.c,v 1.83.2.9.2.4 2006/08/08 14:57:04 iliaa Exp $ */
1203
1204 #include "php.h"
1205
1206@@ -364,10 +364,17 @@
1207 if (!ps_files_path_create(buf, sizeof(buf), data, key))
1208 return FAILURE;
1209
1210- ps_files_close(data);
1211+ if (data->fd != -1) {
1212+ ps_files_close(data);
1213
1214- if (VCWD_UNLINK(buf) == -1) {
1215- return FAILURE;
1216+ if (VCWD_UNLINK(buf) == -1) {
1217+ /* This is a little safety check for instances when we are dealing with a regenerated session
1218+ * that was not yet written to disk
1219+ */
1220+ if (!VCWD_ACCESS(buf, F_OK)) {
1221+ return FAILURE;
1222+ }
1223+ }
1224 }
1225
1226 return SUCCESS;
1227@@ -389,6 +396,34 @@
1228 return SUCCESS;
1229 }
1230
1231+PS_VALIDATE_SID_FUNC(files)
1232+{
1233+ char buf[MAXPATHLEN];
1234+ int fd;
1235+ PS_FILES_DATA;
1236+
1237+ if (!ps_files_valid_key(key)) {
1238+ return FAILURE;
1239+ }
1240+
1241+ if (!PS(use_strict_mode)) {
1242+ return SUCCESS;
1243+ }
1244+
1245+ if (!ps_files_path_create(buf, sizeof(buf), data, key)) {
1246+ return FAILURE;
1247+ }
1248+
1249+ fd = VCWD_OPEN_MODE(buf, O_RDWR | O_BINARY, 0600);
1250+
1251+ if (fd != -1) {
1252+ close(fd);
1253+ return SUCCESS;
1254+ }
1255+
1256+ return FAILURE;
1257+}
1258+
1259 /*
1260 * Local variables:
1261 * tab-width: 4
1262diff -Nura php-4.4.2/ext/session/mod_mm.c hardening-patch-4.4.2-0.4.15/ext/session/mod_mm.c
1263--- php-4.4.2/ext/session/mod_mm.c 2006-01-01 14:46:56.000000000 +0100
1264+++ hardening-patch-4.4.2-0.4.15/ext/session/mod_mm.c 2006-09-05 20:30:33.000000000 +0200
1265@@ -425,6 +425,42 @@
1266 return SUCCESS;
1267 }
1268
1269+PS_VALIDATE_SID_FUNC(mm)
1270+{
1271+ PS_MM_DATA;
1272+ ps_sd *sd;
1273+ const char *p;
1274+ char c;
1275+ int ret = SUCCESS;
1276+
1277+ for (p = key; (c = *p); p++) {
1278+ /* valid characters are a..z,A..Z,0..9 */
1279+ if (!((c >= 'a' && c <= 'z')
1280+ || (c >= 'A' && c <= 'Z')
1281+ || (c >= '0' && c <= '9')
1282+ || c == ','
1283+ || c == '-')) {
1284+ return FAILURE;
1285+ }
1286+ }
1287+
1288+ if (!PS(use_strict_mode)) {
1289+ return SUCCESS;
1290+ }
1291+
1292+ mm_lock(data->mm, MM_LOCK_RD);
1293+
1294+ sd = ps_sd_lookup(data, key, 0);
1295+ if (sd) {
1296+ mm_unlock(data->mm);
1297+ return SUCCESS;
1298+ }
1299+
1300+ mm_unlock(data->mm);
1301+
1302+ return FAILURE;
1303+}
1304+
1305 #endif
1306
1307 /*
1308diff -Nura php-4.4.2/ext/session/mod_user.c hardening-patch-4.4.2-0.4.15/ext/session/mod_user.c
1309--- php-4.4.2/ext/session/mod_user.c 2006-01-01 14:46:56.000000000 +0100
1310+++ hardening-patch-4.4.2-0.4.15/ext/session/mod_user.c 2006-09-05 20:30:33.000000000 +0200
1311@@ -23,7 +23,7 @@
1312 #include "mod_user.h"
1313
1314 ps_module ps_mod_user = {
1315- PS_MOD(user)
1316+ PS_MOD_SID(user)
1317 };
1318
1319 #define SESS_ZVAL_LONG(val, a) \
1320@@ -174,6 +174,83 @@
1321 FINISH;
1322 }
1323
1324+PS_CREATE_SID_FUNC(user)
1325+{
1326+ int i;
1327+ char *val = NULL;
1328+ zval *retval;
1329+ ps_user *mdata = PS_GET_MOD_DATA();
1330+
1331+ if (!mdata)
1332+ return estrndup("", 0);
1333+
1334+ if (PSF(create) == NULL || ZVAL_IS_NULL(PSF(create))) {
1335+ return php_session_create_id(mod_data, newlen TSRMLS_CC);
1336+ }
1337+ retval = ps_call_handler(PSF(create), 0, NULL TSRMLS_CC);
1338+
1339+ if (retval) {
1340+ if (Z_TYPE_P(retval) == IS_STRING) {
1341+ val = estrndup(Z_STRVAL_P(retval), Z_STRLEN_P(retval));
1342+ } else {
1343+ val = estrndup("", 0);
1344+ }
1345+ zval_ptr_dtor(&retval);
1346+ } else {
1347+ val = estrndup("", 0);
1348+ }
1349+
1350+ return val;
1351+}
1352+
1353+static int ps_user_valid_key(const char *key TSRMLS_DC)
1354+{
1355+ size_t len;
1356+ const char *p;
1357+ char c;
1358+ int ret = SUCCESS;
1359+
1360+ for (p = key; (c = *p); p++) {
1361+ /* valid characters are a..z,A..Z,0..9 */
1362+ if (!((c >= 'a' && c <= 'z')
1363+ || (c >= 'A' && c <= 'Z')
1364+ || (c >= '0' && c <= '9')
1365+ || c == ','
1366+ || c == '-')) {
1367+ ret = FAILURE;
1368+ break;
1369+ }
1370+ }
1371+
1372+ len = p - key;
1373+
1374+ if (len == 0)
1375+ ret = FAILURE;
1376+
1377+ return ret;
1378+}
1379+
1380+PS_VALIDATE_SID_FUNC(user)
1381+{
1382+ zval *args[1];
1383+ STDVARS;
1384+
1385+ if (PSF(validate) == NULL || ZVAL_IS_NULL(PSF(validate))) {
1386+ return ps_user_valid_key(key TSRMLS_CC);
1387+ }
1388+ SESS_ZVAL_STRING(key, args[0]);
1389+
1390+ retval = ps_call_handler(PSF(validate), 1, args TSRMLS_CC);
1391+
1392+ if (retval) {
1393+ convert_to_long(retval);
1394+ ret = Z_LVAL_P(retval) ? SUCCESS : FAILURE;
1395+ zval_ptr_dtor(&retval);
1396+ }
1397+
1398+ return ret;
1399+}
1400+
1401 /*
1402 * Local variables:
1403 * tab-width: 4
1404diff -Nura php-4.4.2/ext/session/mod_user.h hardening-patch-4.4.2-0.4.15/ext/session/mod_user.h
1405--- php-4.4.2/ext/session/mod_user.h 2006-01-01 14:46:56.000000000 +0100
1406+++ hardening-patch-4.4.2-0.4.15/ext/session/mod_user.h 2006-09-05 20:30:33.000000000 +0200
1407@@ -22,7 +22,7 @@
1408 #define MOD_USER_H
1409
1410 typedef union {
1411- zval *names[6];
1412+ zval *names[8];
1413 struct {
1414 zval *ps_open;
1415 zval *ps_close;
1416@@ -30,6 +30,8 @@
1417 zval *ps_write;
1418 zval *ps_destroy;
1419 zval *ps_gc;
1420+ zval *ps_create;
1421+ zval *ps_validate;
1422 } name;
1423 } ps_user;
1424
1425diff -Nura php-4.4.2/ext/session/php_session.h hardening-patch-4.4.2-0.4.15/ext/session/php_session.h
1426--- php-4.4.2/ext/session/php_session.h 2006-01-01 14:46:56.000000000 +0100
1427+++ hardening-patch-4.4.2-0.4.15/ext/session/php_session.h 2006-09-05 20:30:33.000000000 +0200
1428@@ -23,7 +23,7 @@
1429
1430 #include "ext/standard/php_var.h"
1431
1432-#define PHP_SESSION_API 20020330
1433+#define PHP_SESSION_API 20051121
1434
1435 #define PS_OPEN_ARGS void **mod_data, const char *save_path, const char *session_name TSRMLS_DC
1436 #define PS_CLOSE_ARGS void **mod_data TSRMLS_DC
1437@@ -32,6 +32,7 @@
1438 #define PS_DESTROY_ARGS void **mod_data, const char *key TSRMLS_DC
1439 #define PS_GC_ARGS void **mod_data, int maxlifetime, int *nrdels TSRMLS_DC
1440 #define PS_CREATE_SID_ARGS void **mod_data, int *newlen TSRMLS_DC
1441+#define PS_VALIDATE_SID_ARGS void **mod_data, const char *key TSRMLS_DC
1442
1443 /* default create id function */
1444 char *php_session_create_id(PS_CREATE_SID_ARGS);
1445@@ -45,6 +46,7 @@
1446 int (*s_destroy)(PS_DESTROY_ARGS);
1447 int (*s_gc)(PS_GC_ARGS);
1448 char *(*s_create_sid)(PS_CREATE_SID_ARGS);
1449+ int (*s_validate_sid)(PS_VALIDATE_SID_ARGS);
1450 } ps_module;
1451
1452 #define PS_GET_MOD_DATA() *mod_data
1453@@ -57,6 +59,7 @@
1454 #define PS_DESTROY_FUNC(x) int ps_delete_##x(PS_DESTROY_ARGS)
1455 #define PS_GC_FUNC(x) int ps_gc_##x(PS_GC_ARGS)
1456 #define PS_CREATE_SID_FUNC(x) char *ps_create_sid_##x(PS_CREATE_SID_ARGS)
1457+#define PS_VALIDATE_SID_FUNC(x) int ps_validate_sid_##x(PS_VALIDATE_SID_ARGS)
1458
1459 #define PS_FUNCS(x) \
1460 PS_OPEN_FUNC(x); \
1461@@ -65,11 +68,12 @@
1462 PS_WRITE_FUNC(x); \
1463 PS_DESTROY_FUNC(x); \
1464 PS_GC_FUNC(x); \
1465- PS_CREATE_SID_FUNC(x)
1466+ PS_CREATE_SID_FUNC(x); \
1467+ PS_VALIDATE_SID_FUNC(x)
1468
1469 #define PS_MOD(x) \
1470 #x, ps_open_##x, ps_close_##x, ps_read_##x, ps_write_##x, \
1471- ps_delete_##x, ps_gc_##x, php_session_create_id
1472+ ps_delete_##x, ps_gc_##x, php_session_create_id, ps_validate_sid_##x
1473
1474 /* SID enabled module handler definitions */
1475 #define PS_FUNCS_SID(x) \
1476@@ -79,11 +83,12 @@
1477 PS_WRITE_FUNC(x); \
1478 PS_DESTROY_FUNC(x); \
1479 PS_GC_FUNC(x); \
1480- PS_CREATE_SID_FUNC(x)
1481+ PS_CREATE_SID_FUNC(x); \
1482+ PS_VALIDATE_SID(x)
1483
1484 #define PS_MOD_SID(x) \
1485 #x, ps_open_##x, ps_close_##x, ps_read_##x, ps_write_##x, \
1486- ps_delete_##x, ps_gc_##x, ps_create_sid_##x
1487+ ps_delete_##x, ps_gc_##x, ps_create_sid_##x, ps_validate_sid_##x
1488
1489 typedef enum {
1490 php_session_disabled,
1491@@ -120,6 +125,7 @@
1492 zend_bool use_only_cookies;
1493 zend_bool use_trans_sid; /* contains the INI value of whether to use trans-sid */
1494 zend_bool apply_trans_sid; /* whether or not to enable trans-sid for the current request */
1495+ zend_bool use_strict_mode; /* whether or not PHP accepts unknown session ids */
1496 int send_cookie;
1497 int define_sid;
1498 } php_ps_globals;
1499diff -Nura php-4.4.2/ext/session/session.c hardening-patch-4.4.2-0.4.15/ext/session/session.c
1500--- php-4.4.2/ext/session/session.c 2006-01-01 14:46:56.000000000 +0100
1501+++ hardening-patch-4.4.2-0.4.15/ext/session/session.c 2006-09-05 20:30:33.000000000 +0200
1502@@ -17,7 +17,7 @@
1503 +----------------------------------------------------------------------+
1504 */
1505
1506-/* $Id: session.c,v 1.336.2.53.2.4 2006/01/01 13:46:56 sniper Exp $ */
1507+/* $Id: session.c,v 1.336.2.53.2.5 2006/01/15 16:52:10 iliaa Exp $ */
1508
1509 #ifdef HAVE_CONFIG_H
1510 #include "config.h"
1511@@ -155,6 +155,7 @@
1512 STD_PHP_INI_BOOLEAN("session.cookie_secure", "", PHP_INI_ALL, OnUpdateBool, cookie_secure, php_ps_globals, ps_globals)
1513 STD_PHP_INI_BOOLEAN("session.use_cookies", "1", PHP_INI_ALL, OnUpdateBool, use_cookies, php_ps_globals, ps_globals)
1514 STD_PHP_INI_BOOLEAN("session.use_only_cookies", "0", PHP_INI_ALL, OnUpdateBool, use_only_cookies, php_ps_globals, ps_globals)
1515+ STD_PHP_INI_BOOLEAN("session.use_strict_mode", "1", PHP_INI_ALL, OnUpdateBool, use_strict_mode, php_ps_globals, ps_globals)
1516 STD_PHP_INI_ENTRY("session.referer_check", "", PHP_INI_ALL, OnUpdateString, extern_referer_chk, php_ps_globals, ps_globals)
1517 STD_PHP_INI_ENTRY("session.entropy_file", "", PHP_INI_ALL, OnUpdateString, entropy_file, php_ps_globals, ps_globals)
1518 STD_PHP_INI_ENTRY("session.entropy_length", "0", PHP_INI_ALL, OnUpdateInt, entropy_length, php_ps_globals, ps_globals)
1519@@ -626,6 +627,12 @@
1520 char *val;
1521 int vallen;
1522
1523+ /* check session name for invalid characters */
1524+ if (PS(id) && strpbrk(PS(id), "\r\n\t <>'\"\\")) {
1525+ efree(PS(id));
1526+ PS(id) = NULL;
1527+ }
1528+
1529 if (!PS(mod)) {
1530 php_error_docref(NULL TSRMLS_CC, E_ERROR, "No storage module chosen - failed to initialize session.");
1531 return;
1532@@ -637,6 +644,15 @@
1533 return;
1534 }
1535
1536+ /* If there is an ID, use session module to verify it */
1537+ if (PS(id)) {
1538+ if (PS(mod)->s_validate_sid(&PS(mod_data), PS(id) TSRMLS_CC) == FAILURE) {
1539+ efree(PS(id));
1540+ PS(id) = NULL;
1541+ PS(send_cookie) = 1;
1542+ }
1543+ }
1544+
1545 /* If there is no ID, use session module to create one */
1546 if (!PS(id))
1547 PS(id) = PS(mod)->s_create_sid(&PS(mod_data), NULL TSRMLS_CC);
1548@@ -1256,22 +1272,31 @@
1549 }
1550 /* }}} */
1551
1552-/* {{{ proto void session_set_save_handler(string open, string close, string read, string write, string destroy, string gc)
1553+/* {{{ proto void session_set_save_handler(string open, string close, string read, string write, string destroy, string gc[, string create, string validate])
1554 Sets user-level functions */
1555 PHP_FUNCTION(session_set_save_handler)
1556 {
1557- zval **args[6];
1558- int i;
1559+ zval **args[8];
1560+ int i, numargs;
1561 ps_user *mdata;
1562 char *name;
1563
1564+ numargs = ZEND_NUM_ARGS();
1565+ args[6] = NULL;
1566+ args[7] = NULL;
1567+
1568+ if (numargs < 6 || numargs > 8 || zend_get_parameters_array_ex(numargs, args) == FAILURE)
1569+ WRONG_PARAM_COUNT;
1570 if (ZEND_NUM_ARGS() != 6 || zend_get_parameters_array_ex(6, args) == FAILURE)
1571 WRONG_PARAM_COUNT;
1572
1573 if (PS(session_status) != php_session_none)
1574 RETURN_FALSE;
1575
1576- for (i = 0; i < 6; i++) {
1577+ for (i = 0; i < 8; i++) {
1578+ if (i >= 6 && (args[i] == NULL || ZVAL_IS_NULL(*args[i]))) {
1579+ continue;
1580+ }
1581 if (!zend_is_callable(*args[i], 0, &name)) {
1582 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Argument %d is not a valid callback", i+1);
1583 efree(name);
1584@@ -1284,7 +1309,11 @@
1585
1586 mdata = emalloc(sizeof(*mdata));
1587
1588- for (i = 0; i < 6; i++) {
1589+ for (i = 0; i < 8; i++) {
1590+ if (i >= 6 && (args[i] == NULL || ZVAL_IS_NULL(*args[i]))) {
1591+ mdata->names[i] = NULL;
1592+ continue;
1593+ }
1594 ZVAL_ADDREF(*args[i]);
1595 mdata->names[i] = *args[i];
1596 }
1597@@ -1345,8 +1374,20 @@
1598 Update the current session id with a newly generated one. */
1599 PHP_FUNCTION(session_regenerate_id)
1600 {
1601+ zend_bool del_ses = 0;
1602+
1603+ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|b", &del_ses) == FAILURE) {
1604+ WRONG_PARAM_COUNT;
1605+ }
1606+
1607 if (PS(session_status) == php_session_active) {
1608- if (PS(id)) efree(PS(id));
1609+ if (PS(id)) {
1610+ if (del_ses && PS(mod)->s_destroy(&PS(mod_data), PS(id) TSRMLS_CC) == FAILURE) {
1611+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Session object destruction failed");
1612+ RETURN_FALSE;
1613+ }
1614+ efree(PS(id));
1615+ }
1616
1617 PS(id) = PS(mod)->s_create_sid(&PS(mod_data), NULL TSRMLS_CC);
1618
1619@@ -1395,8 +1436,8 @@
1620 WRONG_PARAM_COUNT;
1621
1622 if (ac == 1) {
1623- convert_to_long_ex(p_cache_expire);
1624- PS(cache_expire) = Z_LVAL_PP(p_cache_expire);
1625+ convert_to_string_ex(p_cache_expire);
1626+ zend_alter_ini_entry("session.cache_expire", sizeof("session.cache_expire"), Z_STRVAL_PP(p_cache_expire), Z_STRLEN_PP(p_cache_expire), ZEND_INI_USER, ZEND_INI_STAGE_RUNTIME);
1627 }
1628
1629 RETVAL_LONG(old);
1630diff -Nura php-4.4.2/ext/session/tests/014.phpt hardening-patch-4.4.2-0.4.15/ext/session/tests/014.phpt
1631--- php-4.4.2/ext/session/tests/014.phpt 2002-11-26 00:19:18.000000000 +0100
1632+++ hardening-patch-4.4.2-0.4.15/ext/session/tests/014.phpt 2006-09-05 20:30:33.000000000 +0200
1633@@ -5,6 +5,7 @@
1634 --INI--
1635 session.use_trans_sid=1
1636 session.use_cookies=0
1637+session.use_strict_mode=0
1638 session.cache_limiter=
1639 register_globals=1
1640 session.bug_compat_42=1
1641diff -Nura php-4.4.2/ext/session/tests/015.phpt hardening-patch-4.4.2-0.4.15/ext/session/tests/015.phpt
1642--- php-4.4.2/ext/session/tests/015.phpt 2002-11-26 00:19:19.000000000 +0100
1643+++ hardening-patch-4.4.2-0.4.15/ext/session/tests/015.phpt 2006-09-05 20:30:33.000000000 +0200
1644@@ -5,6 +5,7 @@
1645 --INI--
1646 session.use_trans_sid=1
1647 session.use_cookies=0
1648+session.use_strict_mode=0
1649 session.cache_limiter=
1650 arg_separator.output=&
1651 session.name=PHPSESSID
1652diff -Nura php-4.4.2/ext/session/tests/018.phpt hardening-patch-4.4.2-0.4.15/ext/session/tests/018.phpt
1653--- php-4.4.2/ext/session/tests/018.phpt 2002-11-26 00:19:19.000000000 +0100
1654+++ hardening-patch-4.4.2-0.4.15/ext/session/tests/018.phpt 2006-09-05 20:30:33.000000000 +0200
1655@@ -4,6 +4,7 @@
1656 <?php include('skipif.inc'); ?>
1657 --INI--
1658 session.use_cookies=0
1659+session.use_strict_mode=0
1660 session.cache_limiter=
1661 session.use_trans_sid=1
1662 session.name=PHPSESSID
1663diff -Nura php-4.4.2/ext/session/tests/020.phpt hardening-patch-4.4.2-0.4.15/ext/session/tests/020.phpt
1664--- php-4.4.2/ext/session/tests/020.phpt 2002-11-26 00:19:19.000000000 +0100
1665+++ hardening-patch-4.4.2-0.4.15/ext/session/tests/020.phpt 2006-09-05 20:30:33.000000000 +0200
1666@@ -4,6 +4,7 @@
1667 <?php include('skipif.inc'); ?>
1668 --INI--
1669 session.use_cookies=0
1670+session.use_strict_mode=0
1671 session.cache_limiter=
1672 session.use_trans_sid=1
1673 arg_separator.output=&amp;
1674diff -Nura php-4.4.2/ext/session/tests/021.phpt hardening-patch-4.4.2-0.4.15/ext/session/tests/021.phpt
1675--- php-4.4.2/ext/session/tests/021.phpt 2002-11-26 00:19:19.000000000 +0100
1676+++ hardening-patch-4.4.2-0.4.15/ext/session/tests/021.phpt 2006-09-05 20:30:33.000000000 +0200
1677@@ -4,6 +4,7 @@
1678 <?php include('skipif.inc'); ?>
1679 --INI--
1680 session.use_cookies=0
1681+session.use_strict_mode=0
1682 session.cache_limiter=
1683 session.use_trans_sid=1
1684 url_rewriter.tags="a=href,area=href,frame=src,input=src,form=,fieldset="
1685diff -Nura php-4.4.2/ext/session/tests/bug38377.phpt hardening-patch-4.4.2-0.4.15/ext/session/tests/bug38377.phpt
1686--- php-4.4.2/ext/session/tests/bug38377.phpt 1970-01-01 01:00:00.000000000 +0100
1687+++ hardening-patch-4.4.2-0.4.15/ext/session/tests/bug38377.phpt 2006-09-05 20:30:33.000000000 +0200
1688@@ -0,0 +1,13 @@
1689+--TEST--
1690+bug #38377 (session_destroy() gives warning after session_regenerate_id())
1691+--SKIPIF--
1692+<?php include('skipif.inc'); ?>
1693+--FILE--
1694+<?php
1695+session_start();
1696+session_regenerate_id();
1697+session_destroy();
1698+echo "Done\n";
1699+?>
1700+--EXPECT--
1701+Done
1702diff -Nura php-4.4.2/ext/sockets/sockets.c hardening-patch-4.4.2-0.4.15/ext/sockets/sockets.c
1703--- php-4.4.2/ext/sockets/sockets.c 2006-01-01 14:46:56.000000000 +0100
1704+++ hardening-patch-4.4.2-0.4.15/ext/sockets/sockets.c 2006-09-05 20:30:33.000000000 +0200
1705@@ -19,7 +19,7 @@
1706 +----------------------------------------------------------------------+
1707 */
1708
1709-/* $Id: sockets.c,v 1.125.2.29.2.3 2006/01/01 13:46:56 sniper Exp $ */
1710+/* $Id: sockets.c,v 1.125.2.29.2.6 2006/08/01 12:04:14 tony2001 Exp $ */
1711
1712 #ifdef HAVE_CONFIG_H
1713 #include "config.h"
1714@@ -515,6 +515,7 @@
1715 int php_sock_array_to_fd_set(zval *sock_array, fd_set *fds, SOCKET *max_fd TSRMLS_DC) {
1716 zval **element;
1717 php_socket *php_sock;
1718+ int num = 0;
1719
1720 if (Z_TYPE_P(sock_array) != IS_ARRAY) return 0;
1721
1722@@ -529,9 +530,10 @@
1723 if (php_sock->bsd_socket > *max_fd) {
1724 *max_fd = php_sock->bsd_socket;
1725 }
1726+ num++;
1727 }
1728
1729- return 1;
1730+ return num ? 1 : 0;
1731 }
1732
1733 int php_sock_array_from_fd_set(zval *sock_array, fd_set *fds TSRMLS_DC) {
1734@@ -539,6 +541,8 @@
1735 zval **dest_element;
1736 php_socket *php_sock;
1737 HashTable *new_hash;
1738+ int num = 0;
1739+
1740 if (Z_TYPE_P(sock_array) != IS_ARRAY) return 0;
1741
1742 ALLOC_HASHTABLE(new_hash);
1743@@ -555,6 +559,7 @@
1744 zend_hash_next_index_insert(new_hash, (void *)element, sizeof(zval *), (void **)&dest_element);
1745 if (dest_element) zval_add_ref(dest_element);
1746 }
1747+ num++;
1748 }
1749
1750 /* Destroy old array, add new one */
1751@@ -564,7 +569,7 @@
1752 zend_hash_internal_pointer_reset(new_hash);
1753 Z_ARRVAL_P(sock_array) = new_hash;
1754
1755- return 1;
1756+ return num ? 1 : 0;
1757 }
1758
1759
1760diff -Nura php-4.4.2/ext/standard/array.c hardening-patch-4.4.2-0.4.15/ext/standard/array.c
1761--- php-4.4.2/ext/standard/array.c 2006-01-01 14:46:57.000000000 +0100
1762+++ hardening-patch-4.4.2-0.4.15/ext/standard/array.c 2006-09-05 20:30:33.000000000 +0200
1763@@ -1162,6 +1162,32 @@
1764 }
1765 }
1766 }
1767+
1768+ if (var_name[0] == 'H') {
1769+ if ((strcmp(var_name, "HTTP_GET_VARS")==0)||
1770+ (strcmp(var_name, "HTTP_POST_VARS")==0)||
1771+ (strcmp(var_name, "HTTP_POST_FILES")==0)||
1772+ (strcmp(var_name, "HTTP_ENV_VARS")==0)||
1773+ (strcmp(var_name, "HTTP_SERVER_VARS")==0)||
1774+ (strcmp(var_name, "HTTP_SESSION_VARS")==0)||
1775+ (strcmp(var_name, "HTTP_COOKIE_VARS")==0)||
1776+ (strcmp(var_name, "HTTP_RAW_POST_DATA")==0)) {
1777+ return 0;
1778+ }
1779+ } else if (var_name[0] == '_') {
1780+ if ((strcmp(var_name, "_COOKIE")==0)||
1781+ (strcmp(var_name, "_ENV")==0)||
1782+ (strcmp(var_name, "_FILES")==0)||
1783+ (strcmp(var_name, "_GET")==0)||
1784+ (strcmp(var_name, "_POST")==0)||
1785+ (strcmp(var_name, "_REQUEST")==0)||
1786+ (strcmp(var_name, "_SESSION")==0)||
1787+ (strcmp(var_name, "_SERVER")==0)) {
1788+ return 0;
1789+ }
1790+ } else if (strcmp(var_name, "GLOBALS")==0) {
1791+ return 0;
1792+ }
1793
1794 return 1;
1795 }
1796diff -Nura php-4.4.2/ext/standard/basic_functions.c hardening-patch-4.4.2-0.4.15/ext/standard/basic_functions.c
1797--- php-4.4.2/ext/standard/basic_functions.c 2006-01-01 14:46:57.000000000 +0100
1798+++ hardening-patch-4.4.2-0.4.15/ext/standard/basic_functions.c 2006-09-07 19:35:15.000000000 +0200
1799@@ -107,12 +107,14 @@
1800 typedef struct _php_shutdown_function_entry {
1801 zval **arguments;
1802 int arg_count;
1803+ zend_bool created_by_eval;
1804 } php_shutdown_function_entry;
1805
1806 typedef struct _user_tick_function_entry {
1807 zval **arguments;
1808 int arg_count;
1809 int calling;
1810+ zend_bool created_by_eval;
1811 } user_tick_function_entry;
1812
1813 /* some prototypes for local functions */
1814@@ -295,6 +297,8 @@
1815 PHP_FE(get_html_translation_table, NULL)
1816 PHP_FE(sha1, NULL)
1817 PHP_FE(sha1_file, NULL)
1818+ PHP_FE(sha256, NULL)
1819+ PHP_FE(sha256_file, NULL)
1820 PHP_NAMED_FE(md5,php_if_md5, NULL)
1821 PHP_NAMED_FE(md5_file,php_if_md5_file, NULL)
1822 PHP_NAMED_FE(crc32,php_if_crc32, NULL)
1823@@ -676,7 +680,7 @@
1824 PHP_FALIAS(socket_get_status, stream_get_meta_data, NULL)
1825
1826 #if (!defined(__BEOS__) && !defined(NETWARE) && HAVE_REALPATH) || defined(ZTS)
1827- PHP_FE(realpath, NULL)
1828+ PHP_STATIC_FE("realpath", zif_real_path, NULL)
1829 #endif
1830
1831 #ifdef HAVE_FNMATCH
1832@@ -1866,7 +1870,7 @@
1833 break;
1834
1835 case 3: /*save to a file */
1836- stream = php_stream_open_wrapper(opt, "a", IGNORE_URL | ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL);
1837+ stream = php_stream_open_wrapper(opt, "a", IGNORE_URL_WIN | ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL);
1838 if (!stream)
1839 return FAILURE;
1840 php_stream_write(stream, message, strlen(message));
1841@@ -2096,6 +2100,13 @@
1842 {
1843 zval retval;
1844 char *function_name = NULL;
1845+#if HARDENING_PATCH
1846+ zend_uint orig_code_type = EG(in_code_type);
1847+
1848+ if (shutdown_function_entry->created_by_eval) {
1849+ EG(in_code_type) = ZEND_EVAL_CODE;
1850+ }
1851+#endif
1852
1853 if (!zend_is_callable(shutdown_function_entry->arguments[0], 0, &function_name)) {
1854 php_error(E_WARNING, "(Registered shutdown functions) Unable to call %s() - function does not exist", function_name);
1855@@ -2111,6 +2122,9 @@
1856 if (function_name) {
1857 efree(function_name);
1858 }
1859+#if HARDENING_PATCH
1860+ EG(in_code_type) = orig_code_type;
1861+#endif
1862 return 0;
1863 }
1864
1865@@ -2118,6 +2132,13 @@
1866 {
1867 zval retval;
1868 zval *function = tick_fe->arguments[0];
1869+#if HARDENING_PATCH
1870+ zend_uint orig_code_type = EG(in_code_type);
1871+
1872+ if (tick_fe->created_by_eval) {
1873+ EG(in_code_type) = ZEND_EVAL_CODE;
1874+ }
1875+#endif
1876
1877 /* Prevent reentrant calls to the same user ticks function */
1878 if (! tick_fe->calling) {
1879@@ -2149,6 +2170,9 @@
1880
1881 tick_fe->calling = 0;
1882 }
1883+#if HARDENING_PATCH
1884+ EG(in_code_type) = orig_code_type;
1885+#endif
1886 }
1887
1888 static void run_user_tick_functions(int tick_count)
1889@@ -2216,6 +2240,13 @@
1890 if (zend_get_parameters_array(ht, shutdown_function_entry.arg_count, shutdown_function_entry.arguments) == FAILURE) {
1891 RETURN_FALSE;
1892 }
1893+#if HARDENING_PATCH
1894+ if (EG(in_code_type)==ZEND_EVAL_CODE) {
1895+ shutdown_function_entry.created_by_eval = 1;
1896+ } else {
1897+ shutdown_function_entry.created_by_eval = 0;
1898+ }
1899+#endif
1900
1901 /* Prevent entering of anything but valid callback (syntax check only!) */
1902 if (!zend_is_callable(shutdown_function_entry.arguments[0], 1, &function_name)) {
1903@@ -2497,6 +2528,15 @@
1904
1905 convert_to_string_ex(varname);
1906
1907+ /* checks that ensure the user does not overwrite certain ini settings when safe_mode is enabled */
1908+ if (PG(safe_mode)) {
1909+ if (!strncmp("max_execution_time", Z_STRVAL_PP(varname), sizeof("max_execution_time")) ||
1910+ !strncmp("memory_limit", Z_STRVAL_PP(varname), sizeof("memory_limit")) ||
1911+ !strncmp("child_terminate", Z_STRVAL_PP(varname), sizeof("child_terminate"))) {
1912+ RETURN_FALSE;
1913+ }
1914+ }
1915+
1916 zend_restore_ini_entry(Z_STRVAL_PP(varname), Z_STRLEN_PP(varname)+1, PHP_INI_STAGE_RUNTIME);
1917 }
1918 /* }}} */
1919@@ -2753,6 +2793,13 @@
1920 }
1921
1922 tick_fe.arguments = (zval **) safe_emalloc(sizeof(zval *), tick_fe.arg_count, 0);
1923+#if HARDENING_PATCH
1924+ if (EG(in_code_type)==ZEND_EVAL_CODE) {
1925+ tick_fe.created_by_eval = 1;
1926+ } else {
1927+ tick_fe.created_by_eval = 0;
1928+ }
1929+#endif
1930
1931 if (zend_get_parameters_array(ht, tick_fe.arg_count, tick_fe.arguments) == FAILURE) {
1932 RETURN_FALSE;
1933@@ -3050,6 +3097,35 @@
1934 new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h);
1935 }
1936
1937+ if (new_key[0] == 'H') {
1938+ if ((strcmp(new_key, "HTTP_GET_VARS")==0)||
1939+ (strcmp(new_key, "HTTP_POST_VARS")==0)||
1940+ (strcmp(new_key, "HTTP_POST_FILES")==0)||
1941+ (strcmp(new_key, "HTTP_ENV_VARS")==0)||
1942+ (strcmp(new_key, "HTTP_SERVER_VARS")==0)||
1943+ (strcmp(new_key, "HTTP_SESSION_VARS")==0)||
1944+ (strcmp(new_key, "HTTP_COOKIE_VARS")==0)||
1945+ (strcmp(new_key, "HTTP_RAW_POST_DATA")==0)) {
1946+ efree(new_key);
1947+ return 0;
1948+ }
1949+ } else if (new_key[0] == '_') {
1950+ if ((strcmp(new_key, "_COOKIE")==0)||
1951+ (strcmp(new_key, "_ENV")==0)||
1952+ (strcmp(new_key, "_FILES")==0)||
1953+ (strcmp(new_key, "_GET")==0)||
1954+ (strcmp(new_key, "_POST")==0)||
1955+ (strcmp(new_key, "_REQUEST")==0)||
1956+ (strcmp(new_key, "_SESSION")==0)||
1957+ (strcmp(new_key, "_SERVER")==0)) {
1958+ efree(new_key);
1959+ return 0;
1960+ }
1961+ } else if (strcmp(new_key, "GLOBALS")==0) {
1962+ efree(new_key);
1963+ return 0;
1964+ }
1965+
1966 zend_hash_del(&EG(symbol_table), new_key, new_key_len);
1967 ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0);
1968
1969diff -Nura php-4.4.2/ext/standard/config.m4 hardening-patch-4.4.2-0.4.15/ext/standard/config.m4
1970--- php-4.4.2/ext/standard/config.m4 2004-12-30 08:02:18.000000000 +0100
1971+++ hardening-patch-4.4.2-0.4.15/ext/standard/config.m4 2006-09-05 20:30:33.000000000 +0200
1972@@ -203,7 +203,7 @@
1973 if test "$ac_cv_crypt_blowfish" = "yes"; then
1974 ac_result=1
1975 else
1976- ac_result=0
1977+ ac_result=1
1978 fi
1979 AC_DEFINE_UNQUOTED(PHP_BLOWFISH_CRYPT, $ac_result, [Whether the system supports BlowFish salt])
1980 ])
1981@@ -419,6 +419,6 @@
1982 url_scanner.c var.c versioning.c assert.c strnatcmp.c levenshtein.c \
1983 incomplete_class.c url_scanner_ex.c ftp_fopen_wrapper.c \
1984 http_fopen_wrapper.c php_fopen_wrapper.c credits.c css.c \
1985- var_unserializer.c ftok.c aggregation.c sha1.c )
1986+ var_unserializer.c ftok.c aggregation.c sha1.c sha256.c crypt_blowfish.c )
1987
1988 PHP_ADD_MAKEFILE_FRAGMENT
1989diff -Nura php-4.4.2/ext/standard/crypt_blowfish.c hardening-patch-4.4.2-0.4.15/ext/standard/crypt_blowfish.c
1990--- php-4.4.2/ext/standard/crypt_blowfish.c 1970-01-01 01:00:00.000000000 +0100
1991+++ hardening-patch-4.4.2-0.4.15/ext/standard/crypt_blowfish.c 2006-09-05 20:30:33.000000000 +0200
1992@@ -0,0 +1,748 @@
1993+/*
1994+ * This code comes from John the Ripper password cracker, with reentrant
1995+ * and crypt(3) interfaces added, but optimizations specific to password
1996+ * cracking removed.
1997+ *
1998+ * Written by Solar Designer <solar at openwall.com> in 1998-2002 and
1999+ * placed in the public domain.
2000+ *
2001+ * There's absolutely no warranty.
2002+ *
2003+ * It is my intent that you should be able to use this on your system,
2004+ * as a part of a software package, or anywhere else to improve security,
2005+ * ensure compatibility, or for any other purpose. I would appreciate
2006+ * it if you give credit where it is due and keep your modifications in
2007+ * the public domain as well, but I don't require that in order to let
2008+ * you place this code and any modifications you make under a license
2009+ * of your choice.
2010+ *
2011+ * This implementation is compatible with OpenBSD bcrypt.c (version 2a)
2012+ * by Niels Provos <provos at citi.umich.edu>, and uses some of his
2013+ * ideas. The password hashing algorithm was designed by David Mazieres
2014+ * <dm at lcs.mit.edu>.
2015+ *
2016+ * There's a paper on the algorithm that explains its design decisions:
2017+ *
2018+ * http://www.usenix.org/events/usenix99/provos.html
2019+ *
2020+ * Some of the tricks in BF_ROUND might be inspired by Eric Young's
2021+ * Blowfish library (I can't be sure if I would think of something if I
2022+ * hadn't seen his code).
2023+ */
2024+
2025+#include <string.h>
2026+
2027+#include <errno.h>
2028+#ifndef __set_errno
2029+#define __set_errno(val) errno = (val)
2030+#endif
2031+
2032+#undef __CONST
2033+#ifdef __GNUC__
2034+#define __CONST __const
2035+#else
2036+#define __CONST
2037+#endif
2038+
2039+#ifdef __i386__
2040+#define BF_ASM 0
2041+#define BF_SCALE 1
2042+#elif defined(__alpha__) || defined(__hppa__)
2043+#define BF_ASM 0
2044+#define BF_SCALE 1
2045+#else
2046+#define BF_ASM 0
2047+#define BF_SCALE 0
2048+#endif
2049+
2050+typedef unsigned int BF_word;
2051+
2052+/* Number of Blowfish rounds, this is also hardcoded into a few places */
2053+#define BF_N 16
2054+
2055+typedef BF_word BF_key[BF_N + 2];
2056+
2057+typedef struct {
2058+ BF_word S[4][0x100];
2059+ BF_key P;
2060+} BF_ctx;
2061+
2062+/*
2063+ * Magic IV for 64 Blowfish encryptions that we do at the end.
2064+ * The string is "OrpheanBeholderScryDoubt" on big-endian.
2065+ */
2066+static BF_word BF_magic_w[6] = {
2067+ 0x4F727068, 0x65616E42, 0x65686F6C,
2068+ 0x64657253, 0x63727944, 0x6F756274
2069+};
2070+
2071+/*
2072+ * P-box and S-box tables initialized with digits of Pi.
2073+ */
2074+static BF_ctx BF_init_state = {
2075+ {
2076+ {
2077+ 0xd1310ba6, 0x98dfb5ac, 0x2ffd72db, 0xd01adfb7,
2078+ 0xb8e1afed, 0x6a267e96, 0xba7c9045, 0xf12c7f99,
2079+ 0x24a19947, 0xb3916cf7, 0x0801f2e2, 0x858efc16,
2080+ 0x636920d8, 0x71574e69, 0xa458fea3, 0xf4933d7e,
2081+ 0x0d95748f, 0x728eb658, 0x718bcd58, 0x82154aee,
2082+ 0x7b54a41d, 0xc25a59b5, 0x9c30d539, 0x2af26013,
2083+ 0xc5d1b023, 0x286085f0, 0xca417918, 0xb8db38ef,
2084+ 0x8e79dcb0, 0x603a180e, 0x6c9e0e8b, 0xb01e8a3e,
2085+ 0xd71577c1, 0xbd314b27, 0x78af2fda, 0x55605c60,
2086+ 0xe65525f3, 0xaa55ab94, 0x57489862, 0x63e81440,
2087+ 0x55ca396a, 0x2aab10b6, 0xb4cc5c34, 0x1141e8ce,
2088+ 0xa15486af, 0x7c72e993, 0xb3ee1411, 0x636fbc2a,
2089+ 0x2ba9c55d, 0x741831f6, 0xce5c3e16, 0x9b87931e,
2090+ 0xafd6ba33, 0x6c24cf5c, 0x7a325381, 0x28958677,
2091+ 0x3b8f4898, 0x6b4bb9af, 0xc4bfe81b, 0x66282193,
2092+ 0x61d809cc, 0xfb21a991, 0x487cac60, 0x5dec8032,
2093+ 0xef845d5d, 0xe98575b1, 0xdc262302, 0xeb651b88,
2094+ 0x23893e81, 0xd396acc5, 0x0f6d6ff3, 0x83f44239,
2095+ 0x2e0b4482, 0xa4842004, 0x69c8f04a, 0x9e1f9b5e,
2096+ 0x21c66842, 0xf6e96c9a, 0x670c9c61, 0xabd388f0,
2097+ 0x6a51a0d2, 0xd8542f68, 0x960fa728, 0xab5133a3,
2098+ 0x6eef0b6c, 0x137a3be4, 0xba3bf050, 0x7efb2a98,
2099+ 0xa1f1651d, 0x39af0176, 0x66ca593e, 0x82430e88,
2100+ 0x8cee8619, 0x456f9fb4, 0x7d84a5c3, 0x3b8b5ebe,
2101+ 0xe06f75d8, 0x85c12073, 0x401a449f, 0x56c16aa6,
2102+ 0x4ed3aa62, 0x363f7706, 0x1bfedf72, 0x429b023d,
2103+ 0x37d0d724, 0xd00a1248, 0xdb0fead3, 0x49f1c09b,
2104+ 0x075372c9, 0x80991b7b, 0x25d479d8, 0xf6e8def7,
2105+ 0xe3fe501a, 0xb6794c3b, 0x976ce0bd, 0x04c006ba,
2106+ 0xc1a94fb6, 0x409f60c4, 0x5e5c9ec2, 0x196a2463,
2107+ 0x68fb6faf, 0x3e6c53b5, 0x1339b2eb, 0x3b52ec6f,
2108+ 0x6dfc511f, 0x9b30952c, 0xcc814544, 0xaf5ebd09,
2109+ 0xbee3d004, 0xde334afd, 0x660f2807, 0x192e4bb3,
2110+ 0xc0cba857, 0x45c8740f, 0xd20b5f39, 0xb9d3fbdb,
2111+ 0x5579c0bd, 0x1a60320a, 0xd6a100c6, 0x402c7279,
2112+ 0x679f25fe, 0xfb1fa3cc, 0x8ea5e9f8, 0xdb3222f8,
2113+ 0x3c7516df, 0xfd616b15, 0x2f501ec8, 0xad0552ab,
2114+ 0x323db5fa, 0xfd238760, 0x53317b48, 0x3e00df82,
2115+ 0x9e5c57bb, 0xca6f8ca0, 0x1a87562e, 0xdf1769db,
2116+ 0xd542a8f6, 0x287effc3, 0xac6732c6, 0x8c4f5573,
2117+ 0x695b27b0, 0xbbca58c8, 0xe1ffa35d, 0xb8f011a0,
2118+ 0x10fa3d98, 0xfd2183b8, 0x4afcb56c, 0x2dd1d35b,
2119+ 0x9a53e479, 0xb6f84565, 0xd28e49bc, 0x4bfb9790,
2120+ 0xe1ddf2da, 0xa4cb7e33, 0x62fb1341, 0xcee4c6e8,
2121+ 0xef20cada, 0x36774c01, 0xd07e9efe, 0x2bf11fb4,
2122+ 0x95dbda4d, 0xae909198, 0xeaad8e71, 0x6b93d5a0,
2123+ 0xd08ed1d0, 0xafc725e0, 0x8e3c5b2f, 0x8e7594b7,
2124+ 0x8ff6e2fb, 0xf2122b64, 0x8888b812, 0x900df01c,
2125+ 0x4fad5ea0, 0x688fc31c, 0xd1cff191, 0xb3a8c1ad,
2126+ 0x2f2f2218, 0xbe0e1777, 0xea752dfe, 0x8b021fa1,
2127+ 0xe5a0cc0f, 0xb56f74e8, 0x18acf3d6, 0xce89e299,
2128+ 0xb4a84fe0, 0xfd13e0b7, 0x7cc43b81, 0xd2ada8d9,
2129+ 0x165fa266, 0x80957705, 0x93cc7314, 0x211a1477,
2130+ 0xe6ad2065, 0x77b5fa86, 0xc75442f5, 0xfb9d35cf,
2131+ 0xebcdaf0c, 0x7b3e89a0, 0xd6411bd3, 0xae1e7e49,
2132+ 0x00250e2d, 0x2071b35e, 0x226800bb, 0x57b8e0af,
2133+ 0x2464369b, 0xf009b91e, 0x5563911d, 0x59dfa6aa,
2134+ 0x78c14389, 0xd95a537f, 0x207d5ba2, 0x02e5b9c5,
2135+ 0x83260376, 0x6295cfa9, 0x11c81968, 0x4e734a41,
2136+ 0xb3472dca, 0x7b14a94a, 0x1b510052, 0x9a532915,
2137+ 0xd60f573f, 0xbc9bc6e4, 0x2b60a476, 0x81e67400,
2138+ 0x08ba6fb5, 0x571be91f, 0xf296ec6b, 0x2a0dd915,
2139+ 0xb6636521, 0xe7b9f9b6, 0xff34052e, 0xc5855664,
2140+ 0x53b02d5d, 0xa99f8fa1, 0x08ba4799, 0x6e85076a
2141+ }, {
2142+ 0x4b7a70e9, 0xb5b32944, 0xdb75092e, 0xc4192623,
2143+ 0xad6ea6b0, 0x49a7df7d, 0x9cee60b8, 0x8fedb266,
2144+ 0xecaa8c71, 0x699a17ff, 0x5664526c, 0xc2b19ee1,
2145+ 0x193602a5, 0x75094c29, 0xa0591340, 0xe4183a3e,
2146+ 0x3f54989a, 0x5b429d65, 0x6b8fe4d6, 0x99f73fd6,
2147+ 0xa1d29c07, 0xefe830f5, 0x4d2d38e6, 0xf0255dc1,
2148+ 0x4cdd2086, 0x8470eb26, 0x6382e9c6, 0x021ecc5e,
2149+ 0x09686b3f, 0x3ebaefc9, 0x3c971814, 0x6b6a70a1,
2150+ 0x687f3584, 0x52a0e286, 0xb79c5305, 0xaa500737,
2151+ 0x3e07841c, 0x7fdeae5c, 0x8e7d44ec, 0x5716f2b8,
2152+ 0xb03ada37, 0xf0500c0d, 0xf01c1f04, 0x0200b3ff,
2153+ 0xae0cf51a, 0x3cb574b2, 0x25837a58, 0xdc0921bd,
2154+ 0xd19113f9, 0x7ca92ff6, 0x94324773, 0x22f54701,
2155+ 0x3ae5e581, 0x37c2dadc, 0xc8b57634, 0x9af3dda7,
2156+ 0xa9446146, 0x0fd0030e, 0xecc8c73e, 0xa4751e41,
2157+ 0xe238cd99, 0x3bea0e2f, 0x3280bba1, 0x183eb331,
2158+ 0x4e548b38, 0x4f6db908, 0x6f420d03, 0xf60a04bf,
2159+ 0x2cb81290, 0x24977c79, 0x5679b072, 0xbcaf89af,
2160+ 0xde9a771f, 0xd9930810, 0xb38bae12, 0xdccf3f2e,
2161+ 0x5512721f, 0x2e6b7124, 0x501adde6, 0x9f84cd87,
2162+ 0x7a584718, 0x7408da17, 0xbc9f9abc, 0xe94b7d8c,
2163+ 0xec7aec3a, 0xdb851dfa, 0x63094366, 0xc464c3d2,
2164+ 0xef1c1847, 0x3215d908, 0xdd433b37, 0x24c2ba16,
2165+ 0x12a14d43, 0x2a65c451, 0x50940002, 0x133ae4dd,
2166+ 0x71dff89e, 0x10314e55, 0x81ac77d6, 0x5f11199b,
2167+ 0x043556f1, 0xd7a3c76b, 0x3c11183b, 0x5924a509,
2168+ 0xf28fe6ed, 0x97f1fbfa, 0x9ebabf2c, 0x1e153c6e,
2169+ 0x86e34570, 0xeae96fb1, 0x860e5e0a, 0x5a3e2ab3,
2170+ 0x771fe71c, 0x4e3d06fa, 0x2965dcb9, 0x99e71d0f,
2171+ 0x803e89d6, 0x5266c825, 0x2e4cc978, 0x9c10b36a,
2172+ 0xc6150eba, 0x94e2ea78, 0xa5fc3c53, 0x1e0a2df4,
2173+ 0xf2f74ea7, 0x361d2b3d, 0x1939260f, 0x19c27960,
2174+ 0x5223a708, 0xf71312b6, 0xebadfe6e, 0xeac31f66,
2175+ 0xe3bc4595, 0xa67bc883, 0xb17f37d1, 0x018cff28,
2176+ 0xc332ddef, 0xbe6c5aa5, 0x65582185, 0x68ab9802,
2177+ 0xeecea50f, 0xdb2f953b, 0x2aef7dad, 0x5b6e2f84,
2178+ 0x1521b628, 0x29076170, 0xecdd4775, 0x619f1510,
2179+ 0x13cca830, 0xeb61bd96, 0x0334fe1e, 0xaa0363cf,
2180+ 0xb5735c90, 0x4c70a239, 0xd59e9e0b, 0xcbaade14,
2181+ 0xeecc86bc, 0x60622ca7, 0x9cab5cab, 0xb2f3846e,
2182+ 0x648b1eaf, 0x19bdf0ca, 0xa02369b9, 0x655abb50,
2183+ 0x40685a32, 0x3c2ab4b3, 0x319ee9d5, 0xc021b8f7,
2184+ 0x9b540b19, 0x875fa099, 0x95f7997e, 0x623d7da8,
2185+ 0xf837889a, 0x97e32d77, 0x11ed935f, 0x16681281,
2186+ 0x0e358829, 0xc7e61fd6, 0x96dedfa1, 0x7858ba99,
2187+ 0x57f584a5, 0x1b227263, 0x9b83c3ff, 0x1ac24696,
2188+ 0xcdb30aeb, 0x532e3054, 0x8fd948e4, 0x6dbc3128,
2189+ 0x58ebf2ef, 0x34c6ffea, 0xfe28ed61, 0xee7c3c73,
2190+ 0x5d4a14d9, 0xe864b7e3, 0x42105d14, 0x203e13e0,
2191+ 0x45eee2b6, 0xa3aaabea, 0xdb6c4f15, 0xfacb4fd0,
2192+ 0xc742f442, 0xef6abbb5, 0x654f3b1d, 0x41cd2105,
2193+ 0xd81e799e, 0x86854dc7, 0xe44b476a, 0x3d816250,
2194+ 0xcf62a1f2, 0x5b8d2646, 0xfc8883a0, 0xc1c7b6a3,
2195+ 0x7f1524c3, 0x69cb7492, 0x47848a0b, 0x5692b285,
2196+ 0x095bbf00, 0xad19489d, 0x1462b174, 0x23820e00,
2197+ 0x58428d2a, 0x0c55f5ea, 0x1dadf43e, 0x233f7061,
2198+ 0x3372f092, 0x8d937e41, 0xd65fecf1, 0x6c223bdb,
2199+ 0x7cde3759, 0xcbee7460, 0x4085f2a7, 0xce77326e,
2200+ 0xa6078084, 0x19f8509e, 0xe8efd855, 0x61d99735,
2201+ 0xa969a7aa, 0xc50c06c2, 0x5a04abfc, 0x800bcadc,
2202+ 0x9e447a2e, 0xc3453484, 0xfdd56705, 0x0e1e9ec9,
2203+ 0xdb73dbd3, 0x105588cd, 0x675fda79, 0xe3674340,
2204+ 0xc5c43465, 0x713e38d8, 0x3d28f89e, 0xf16dff20,
2205+ 0x153e21e7, 0x8fb03d4a, 0xe6e39f2b, 0xdb83adf7
2206+ }, {
2207+ 0xe93d5a68, 0x948140f7, 0xf64c261c, 0x94692934,
2208+ 0x411520f7, 0x7602d4f7, 0xbcf46b2e, 0xd4a20068,
2209+ 0xd4082471, 0x3320f46a, 0x43b7d4b7, 0x500061af,
2210+ 0x1e39f62e, 0x97244546, 0x14214f74, 0xbf8b8840,
2211+ 0x4d95fc1d, 0x96b591af, 0x70f4ddd3, 0x66a02f45,
2212+ 0xbfbc09ec, 0x03bd9785, 0x7fac6dd0, 0x31cb8504,
2213+ 0x96eb27b3, 0x55fd3941, 0xda2547e6, 0xabca0a9a,
2214+ 0x28507825, 0x530429f4, 0x0a2c86da, 0xe9b66dfb,
2215+ 0x68dc1462, 0xd7486900, 0x680ec0a4, 0x27a18dee,
2216+ 0x4f3ffea2, 0xe887ad8c, 0xb58ce006, 0x7af4d6b6,
2217+ 0xaace1e7c, 0xd3375fec, 0xce78a399, 0x406b2a42,
2218+ 0x20fe9e35, 0xd9f385b9, 0xee39d7ab, 0x3b124e8b,
2219+ 0x1dc9faf7, 0x4b6d1856, 0x26a36631, 0xeae397b2,
2220+ 0x3a6efa74, 0xdd5b4332, 0x6841e7f7, 0xca7820fb,
2221+ 0xfb0af54e, 0xd8feb397, 0x454056ac, 0xba489527,
2222+ 0x55533a3a, 0x20838d87, 0xfe6ba9b7, 0xd096954b,
2223+ 0x55a867bc, 0xa1159a58, 0xcca92963, 0x99e1db33,
2224+ 0xa62a4a56, 0x3f3125f9, 0x5ef47e1c, 0x9029317c,
2225+ 0xfdf8e802, 0x04272f70, 0x80bb155c, 0x05282ce3,
2226+ 0x95c11548, 0xe4c66d22, 0x48c1133f, 0xc70f86dc,
2227+ 0x07f9c9ee, 0x41041f0f, 0x404779a4, 0x5d886e17,
2228+ 0x325f51eb, 0xd59bc0d1, 0xf2bcc18f, 0x41113564,
2229+ 0x257b7834, 0x602a9c60, 0xdff8e8a3, 0x1f636c1b,
2230+ 0x0e12b4c2, 0x02e1329e, 0xaf664fd1, 0xcad18115,
2231+ 0x6b2395e0, 0x333e92e1, 0x3b240b62, 0xeebeb922,
2232+ 0x85b2a20e, 0xe6ba0d99, 0xde720c8c, 0x2da2f728,
2233+ 0xd0127845, 0x95b794fd, 0x647d0862, 0xe7ccf5f0,
2234+ 0x5449a36f, 0x877d48fa, 0xc39dfd27, 0xf33e8d1e,
2235+ 0x0a476341, 0x992eff74, 0x3a6f6eab, 0xf4f8fd37,
2236+ 0xa812dc60, 0xa1ebddf8, 0x991be14c, 0xdb6e6b0d,
2237+ 0xc67b5510, 0x6d672c37, 0x2765d43b, 0xdcd0e804,
2238+ 0xf1290dc7, 0xcc00ffa3, 0xb5390f92, 0x690fed0b,
2239+ 0x667b9ffb, 0xcedb7d9c, 0xa091cf0b, 0xd9155ea3,
2240+ 0xbb132f88, 0x515bad24, 0x7b9479bf, 0x763bd6eb,
2241+ 0x37392eb3, 0xcc115979, 0x8026e297, 0xf42e312d,
2242+ 0x6842ada7, 0xc66a2b3b, 0x12754ccc, 0x782ef11c,
2243+ 0x6a124237, 0xb79251e7, 0x06a1bbe6, 0x4bfb6350,
2244+ 0x1a6b1018, 0x11caedfa, 0x3d25bdd8, 0xe2e1c3c9,
2245+ 0x44421659, 0x0a121386, 0xd90cec6e, 0xd5abea2a,
2246+ 0x64af674e, 0xda86a85f, 0xbebfe988, 0x64e4c3fe,
2247+ 0x9dbc8057, 0xf0f7c086, 0x60787bf8, 0x6003604d,
2248+ 0xd1fd8346, 0xf6381fb0, 0x7745ae04, 0xd736fccc,
2249+ 0x83426b33, 0xf01eab71, 0xb0804187, 0x3c005e5f,
2250+ 0x77a057be, 0xbde8ae24, 0x55464299, 0xbf582e61,
2251+ 0x4e58f48f, 0xf2ddfda2, 0xf474ef38, 0x8789bdc2,
2252+ 0x5366f9c3, 0xc8b38e74, 0xb475f255, 0x46fcd9b9,
2253+ 0x7aeb2661, 0x8b1ddf84, 0x846a0e79, 0x915f95e2,
2254+ 0x466e598e, 0x20b45770, 0x8cd55591, 0xc902de4c,
2255+ 0xb90bace1, 0xbb8205d0, 0x11a86248, 0x7574a99e,
2256+ 0xb77f19b6, 0xe0a9dc09, 0x662d09a1, 0xc4324633,
2257+ 0xe85a1f02, 0x09f0be8c, 0x4a99a025, 0x1d6efe10,
2258+ 0x1ab93d1d, 0x0ba5a4df, 0xa186f20f, 0x2868f169,
2259+ 0xdcb7da83, 0x573906fe, 0xa1e2ce9b, 0x4fcd7f52,
2260+ 0x50115e01, 0xa70683fa, 0xa002b5c4, 0x0de6d027,
2261+ 0x9af88c27, 0x773f8641, 0xc3604c06, 0x61a806b5,
2262+ 0xf0177a28, 0xc0f586e0, 0x006058aa, 0x30dc7d62,
2263+ 0x11e69ed7, 0x2338ea63, 0x53c2dd94, 0xc2c21634,
2264+ 0xbbcbee56, 0x90bcb6de, 0xebfc7da1, 0xce591d76,
2265+ 0x6f05e409, 0x4b7c0188, 0x39720a3d, 0x7c927c24,
2266+ 0x86e3725f, 0x724d9db9, 0x1ac15bb4, 0xd39eb8fc,
2267+ 0xed545578, 0x08fca5b5, 0xd83d7cd3, 0x4dad0fc4,
2268+ 0x1e50ef5e, 0xb161e6f8, 0xa28514d9, 0x6c51133c,
2269+ 0x6fd5c7e7, 0x56e14ec4, 0x362abfce, 0xddc6c837,
2270+ 0xd79a3234, 0x92638212, 0x670efa8e, 0x406000e0
2271+ }, {
2272+ 0x3a39ce37, 0xd3faf5cf, 0xabc27737, 0x5ac52d1b,
2273+ 0x5cb0679e, 0x4fa33742, 0xd3822740, 0x99bc9bbe,
2274+ 0xd5118e9d, 0xbf0f7315, 0xd62d1c7e, 0xc700c47b,
2275+ 0xb78c1b6b, 0x21a19045, 0xb26eb1be, 0x6a366eb4,
2276+ 0x5748ab2f, 0xbc946e79, 0xc6a376d2, 0x6549c2c8,
2277+ 0x530ff8ee, 0x468dde7d, 0xd5730a1d, 0x4cd04dc6,
2278+ 0x2939bbdb, 0xa9ba4650, 0xac9526e8, 0xbe5ee304,
2279+ 0xa1fad5f0, 0x6a2d519a, 0x63ef8ce2, 0x9a86ee22,
2280+ 0xc089c2b8, 0x43242ef6, 0xa51e03aa, 0x9cf2d0a4,
2281+ 0x83c061ba, 0x9be96a4d, 0x8fe51550, 0xba645bd6,
2282+ 0x2826a2f9, 0xa73a3ae1, 0x4ba99586, 0xef5562e9,
2283+ 0xc72fefd3, 0xf752f7da, 0x3f046f69, 0x77fa0a59,
2284+ 0x80e4a915, 0x87b08601, 0x9b09e6ad, 0x3b3ee593,
2285+ 0xe990fd5a, 0x9e34d797, 0x2cf0b7d9, 0x022b8b51,
2286+ 0x96d5ac3a, 0x017da67d, 0xd1cf3ed6, 0x7c7d2d28,
2287+ 0x1f9f25cf, 0xadf2b89b, 0x5ad6b472, 0x5a88f54c,
2288+ 0xe029ac71, 0xe019a5e6, 0x47b0acfd, 0xed93fa9b,
2289+ 0xe8d3c48d, 0x283b57cc, 0xf8d56629, 0x79132e28,
2290+ 0x785f0191, 0xed756055, 0xf7960e44, 0xe3d35e8c,
2291+ 0x15056dd4, 0x88f46dba, 0x03a16125, 0x0564f0bd,
2292+ 0xc3eb9e15, 0x3c9057a2, 0x97271aec, 0xa93a072a,
2293+ 0x1b3f6d9b, 0x1e6321f5, 0xf59c66fb, 0x26dcf319,
2294+ 0x7533d928, 0xb155fdf5, 0x03563482, 0x8aba3cbb,
2295+ 0x28517711, 0xc20ad9f8, 0xabcc5167, 0xccad925f,
2296+ 0x4de81751, 0x3830dc8e, 0x379d5862, 0x9320f991,
2297+ 0xea7a90c2, 0xfb3e7bce, 0x5121ce64, 0x774fbe32,
2298+ 0xa8b6e37e, 0xc3293d46, 0x48de5369, 0x6413e680,
2299+ 0xa2ae0810, 0xdd6db224, 0x69852dfd, 0x09072166,
2300+ 0xb39a460a, 0x6445c0dd, 0x586cdecf, 0x1c20c8ae,
2301+ 0x5bbef7dd, 0x1b588d40, 0xccd2017f, 0x6bb4e3bb,
2302+ 0xdda26a7e, 0x3a59ff45, 0x3e350a44, 0xbcb4cdd5,
2303+ 0x72eacea8, 0xfa6484bb, 0x8d6612ae, 0xbf3c6f47,
2304+ 0xd29be463, 0x542f5d9e, 0xaec2771b, 0xf64e6370,
2305+ 0x740e0d8d, 0xe75b1357, 0xf8721671, 0xaf537d5d,
2306+ 0x4040cb08, 0x4eb4e2cc, 0x34d2466a, 0x0115af84,
2307+ 0xe1b00428, 0x95983a1d, 0x06b89fb4, 0xce6ea048,
2308+ 0x6f3f3b82, 0x3520ab82, 0x011a1d4b, 0x277227f8,
2309+ 0x611560b1, 0xe7933fdc, 0xbb3a792b, 0x344525bd,
2310+ 0xa08839e1, 0x51ce794b, 0x2f32c9b7, 0xa01fbac9,
2311+ 0xe01cc87e, 0xbcc7d1f6, 0xcf0111c3, 0xa1e8aac7,
2312+ 0x1a908749, 0xd44fbd9a, 0xd0dadecb, 0xd50ada38,
2313+ 0x0339c32a, 0xc6913667, 0x8df9317c, 0xe0b12b4f,
2314+ 0xf79e59b7, 0x43f5bb3a, 0xf2d519ff, 0x27d9459c,
2315+ 0xbf97222c, 0x15e6fc2a, 0x0f91fc71, 0x9b941525,
2316+ 0xfae59361, 0xceb69ceb, 0xc2a86459, 0x12baa8d1,
2317+ 0xb6c1075e, 0xe3056a0c, 0x10d25065, 0xcb03a442,
2318+ 0xe0ec6e0e, 0x1698db3b, 0x4c98a0be, 0x3278e964,
2319+ 0x9f1f9532, 0xe0d392df, 0xd3a0342b, 0x8971f21e,
2320+ 0x1b0a7441, 0x4ba3348c, 0xc5be7120, 0xc37632d8,
2321+ 0xdf359f8d, 0x9b992f2e, 0xe60b6f47, 0x0fe3f11d,
2322+ 0xe54cda54, 0x1edad891, 0xce6279cf, 0xcd3e7e6f,
2323+ 0x1618b166, 0xfd2c1d05, 0x848fd2c5, 0xf6fb2299,
2324+ 0xf523f357, 0xa6327623, 0x93a83531, 0x56cccd02,
2325+ 0xacf08162, 0x5a75ebb5, 0x6e163697, 0x88d273cc,
2326+ 0xde966292, 0x81b949d0, 0x4c50901b, 0x71c65614,
2327+ 0xe6c6c7bd, 0x327a140a, 0x45e1d006, 0xc3f27b9a,
2328+ 0xc9aa53fd, 0x62a80f00, 0xbb25bfe2, 0x35bdd2f6,
2329+ 0x71126905, 0xb2040222, 0xb6cbcf7c, 0xcd769c2b,
2330+ 0x53113ec0, 0x1640e3d3, 0x38abbd60, 0x2547adf0,
2331+ 0xba38209c, 0xf746ce76, 0x77afa1c5, 0x20756060,
2332+ 0x85cbfe4e, 0x8ae88dd8, 0x7aaaf9b0, 0x4cf9aa7e,
2333+ 0x1948c25c, 0x02fb8a8c, 0x01c36ae4, 0xd6ebe1f9,
2334+ 0x90d4f869, 0xa65cdea0, 0x3f09252d, 0xc208e69f,
2335+ 0xb74e6132, 0xce77e25b, 0x578fdfe3, 0x3ac372e6
2336+ }
2337+ }, {
2338+ 0x243f6a88, 0x85a308d3, 0x13198a2e, 0x03707344,
2339+ 0xa4093822, 0x299f31d0, 0x082efa98, 0xec4e6c89,
2340+ 0x452821e6, 0x38d01377, 0xbe5466cf, 0x34e90c6c,
2341+ 0xc0ac29b7, 0xc97c50dd, 0x3f84d5b5, 0xb5470917,
2342+ 0x9216d5d9, 0x8979fb1b
2343+ }
2344+};
2345+
2346+static unsigned char BF_itoa64[64 + 1] =
2347+ "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
2348+
2349+static unsigned char BF_atoi64[0x60] = {
2350+ 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 0, 1,
2351+ 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 64, 64, 64, 64, 64,
2352+ 64, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
2353+ 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 64, 64, 64, 64, 64,
2354+ 64, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42,
2355+ 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 64, 64, 64, 64, 64
2356+};
2357+
2358+/*
2359+ * This may be optimized out if built with function inlining and no BF_ASM.
2360+ */
2361+static void clean(void *data, int size)
2362+{
2363+#if BF_ASM
2364+ extern void _BF_clean(void *data);
2365+#endif
2366+ memset(data, 0, size);
2367+#if BF_ASM
2368+ _BF_clean(data);
2369+#endif
2370+}
2371+
2372+#define BF_safe_atoi64(dst, src) \
2373+{ \
2374+ tmp = (unsigned char)(src); \
2375+ if (tmp == '$') break; \
2376+ if ((unsigned int)(tmp -= 0x20) >= 0x60) return -1; \
2377+ tmp = BF_atoi64[tmp]; \
2378+ if (tmp > 63) return -1; \
2379+ (dst) = tmp; \
2380+}
2381+
2382+static int BF_decode(BF_word *dst, __CONST char *src, int size)
2383+{
2384+ unsigned char *dptr = (unsigned char *)dst;
2385+ unsigned char *end = dptr + size;
2386+ unsigned char *sptr = (unsigned char *)src;
2387+ unsigned int tmp, c1, c2, c3, c4;
2388+
2389+ do {
2390+ BF_safe_atoi64(c1, *sptr++);
2391+ BF_safe_atoi64(c2, *sptr++);
2392+ *dptr++ = (c1 << 2) | ((c2 & 0x30) >> 4);
2393+ if (dptr >= end) break;
2394+
2395+ BF_safe_atoi64(c3, *sptr++);
2396+ *dptr++ = ((c2 & 0x0F) << 4) | ((c3 & 0x3C) >> 2);
2397+ if (dptr >= end) break;
2398+
2399+ BF_safe_atoi64(c4, *sptr++);
2400+ *dptr++ = ((c3 & 0x03) << 6) | c4;
2401+ } while (dptr < end);
2402+
2403+ while (dptr < end)
2404+ *dptr++ = 0;
2405+
2406+ return 0;
2407+}
2408+
2409+static void BF_encode(char *dst, __CONST BF_word *src, int size)
2410+{
2411+ unsigned char *sptr = (unsigned char *)src;
2412+ unsigned char *end = sptr + size;
2413+ unsigned char *dptr = (unsigned char *)dst;
2414+ unsigned int c1, c2;
2415+
2416+ do {
2417+ c1 = *sptr++;
2418+ *dptr++ = BF_itoa64[c1 >> 2];
2419+ c1 = (c1 & 0x03) << 4;
2420+ if (sptr >= end) {
2421+ *dptr++ = BF_itoa64[c1];
2422+ break;
2423+ }
2424+
2425+ c2 = *sptr++;
2426+ c1 |= c2 >> 4;
2427+ *dptr++ = BF_itoa64[c1];
2428+ c1 = (c2 & 0x0f) << 2;
2429+ if (sptr >= end) {
2430+ *dptr++ = BF_itoa64[c1];
2431+ break;
2432+ }
2433+
2434+ c2 = *sptr++;
2435+ c1 |= c2 >> 6;
2436+ *dptr++ = BF_itoa64[c1];
2437+ *dptr++ = BF_itoa64[c2 & 0x3f];
2438+ } while (sptr < end);
2439+}
2440+
2441+static void BF_swap(BF_word *x, int count)
2442+{
2443+ static int endianness_check = 1;
2444+ char *is_little_endian = (char *)&endianness_check;
2445+ BF_word tmp;
2446+
2447+ if (*is_little_endian)
2448+ do {
2449+ tmp = *x;
2450+ tmp = (tmp << 16) | (tmp >> 16);
2451+ *x++ = ((tmp & 0x00FF00FF) << 8) | ((tmp >> 8) & 0x00FF00FF);
2452+ } while (--count);
2453+}
2454+
2455+#if BF_SCALE
2456+/* Architectures which can shift addresses left by 2 bits with no extra cost */
2457+#define BF_ROUND(L, R, N) \
2458+ tmp1 = L & 0xFF; \
2459+ tmp2 = L >> 8; \
2460+ tmp2 &= 0xFF; \
2461+ tmp3 = L >> 16; \
2462+ tmp3 &= 0xFF; \
2463+ tmp4 = L >> 24; \
2464+ tmp1 = data.ctx.S[3][tmp1]; \
2465+ tmp2 = data.ctx.S[2][tmp2]; \
2466+ tmp3 = data.ctx.S[1][tmp3]; \
2467+ tmp3 += data.ctx.S[0][tmp4]; \
2468+ tmp3 ^= tmp2; \
2469+ R ^= data.ctx.P[N + 1]; \
2470+ tmp3 += tmp1; \
2471+ R ^= tmp3;
2472+#else
2473+/* Architectures with no complicated addressing modes supported */
2474+#define BF_INDEX(S, i) \
2475+ (*((BF_word *)(((unsigned char *)S) + (i))))
2476+#define BF_ROUND(L, R, N) \
2477+ tmp1 = L & 0xFF; \
2478+ tmp1 <<= 2; \
2479+ tmp2 = L >> 6; \
2480+ tmp2 &= 0x3FC; \
2481+ tmp3 = L >> 14; \
2482+ tmp3 &= 0x3FC; \
2483+ tmp4 = L >> 22; \
2484+ tmp4 &= 0x3FC; \
2485+ tmp1 = BF_INDEX(data.ctx.S[3], tmp1); \
2486+ tmp2 = BF_INDEX(data.ctx.S[2], tmp2); \
2487+ tmp3 = BF_INDEX(data.ctx.S[1], tmp3); \
2488+ tmp3 += BF_INDEX(data.ctx.S[0], tmp4); \
2489+ tmp3 ^= tmp2; \
2490+ R ^= data.ctx.P[N + 1]; \
2491+ tmp3 += tmp1; \
2492+ R ^= tmp3;
2493+#endif
2494+
2495+/*
2496+ * Encrypt one block, BF_N is hardcoded here.
2497+ */
2498+#define BF_ENCRYPT \
2499+ L ^= data.ctx.P[0]; \
2500+ BF_ROUND(L, R, 0); \
2501+ BF_ROUND(R, L, 1); \
2502+ BF_ROUND(L, R, 2); \
2503+ BF_ROUND(R, L, 3); \
2504+ BF_ROUND(L, R, 4); \
2505+ BF_ROUND(R, L, 5); \
2506+ BF_ROUND(L, R, 6); \
2507+ BF_ROUND(R, L, 7); \
2508+ BF_ROUND(L, R, 8); \
2509+ BF_ROUND(R, L, 9); \
2510+ BF_ROUND(L, R, 10); \
2511+ BF_ROUND(R, L, 11); \
2512+ BF_ROUND(L, R, 12); \
2513+ BF_ROUND(R, L, 13); \
2514+ BF_ROUND(L, R, 14); \
2515+ BF_ROUND(R, L, 15); \
2516+ tmp4 = R; \
2517+ R = L; \
2518+ L = tmp4 ^ data.ctx.P[BF_N + 1];
2519+
2520+#if BF_ASM
2521+#define BF_body() \
2522+ _BF_body_r(&data.ctx);
2523+#else
2524+#define BF_body() \
2525+ L = R = 0; \
2526+ ptr = data.ctx.P; \
2527+ do { \
2528+ ptr += 2; \
2529+ BF_ENCRYPT; \
2530+ *(ptr - 2) = L; \
2531+ *(ptr - 1) = R; \
2532+ } while (ptr < &data.ctx.P[BF_N + 2]); \
2533+\
2534+ ptr = data.ctx.S[0]; \
2535+ do { \
2536+ ptr += 2; \
2537+ BF_ENCRYPT; \
2538+ *(ptr - 2) = L; \
2539+ *(ptr - 1) = R; \
2540+ } while (ptr < &data.ctx.S[3][0xFF]);
2541+#endif
2542+
2543+static void BF_set_key(__CONST char *key, BF_key expanded, BF_key initial)
2544+{
2545+ __CONST char *ptr = key;
2546+ int i, j;
2547+ BF_word tmp;
2548+
2549+ for (i = 0; i < BF_N + 2; i++) {
2550+ tmp = 0;
2551+ for (j = 0; j < 4; j++) {
2552+ tmp <<= 8;
2553+ tmp |= *ptr;
2554+
2555+ if (!*ptr) ptr = key; else ptr++;
2556+ }
2557+
2558+ expanded[i] = tmp;
2559+ initial[i] = BF_init_state.P[i] ^ tmp;
2560+ }
2561+}
2562+
2563+char *_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
2564+ char *output, int size)
2565+{
2566+#if BF_ASM
2567+ extern void _BF_body_r(BF_ctx *ctx);
2568+#endif
2569+ struct {
2570+ BF_ctx ctx;
2571+ BF_key expanded_key;
2572+ union {
2573+ BF_word salt[4];
2574+ BF_word output[6];
2575+ } binary;
2576+ } data;
2577+ BF_word L, R;
2578+ BF_word tmp1, tmp2, tmp3, tmp4;
2579+ BF_word *ptr;
2580+ BF_word count;
2581+ int i;
2582+
2583+ if (size < 7 + 22 + 31 + 1) {
2584+ __set_errno(ERANGE);
2585+ return NULL;
2586+ }
2587+
2588+ if (setting[0] != '$' ||
2589+ setting[1] != '2' ||
2590+ setting[2] != 'a' ||
2591+ setting[3] != '$' ||
2592+ setting[4] < '0' || setting[4] > '3' ||
2593+ setting[5] < '0' || setting[5] > '9' ||
2594+ setting[6] != '$') {
2595+ __set_errno(EINVAL);
2596+ return NULL;
2597+ }
2598+
2599+ count = (BF_word)1 << ((setting[4] - '0') * 10 + (setting[5] - '0'));
2600+ if (count < 16 || BF_decode(data.binary.salt, &setting[7], 16)) {
2601+ clean(data.binary.salt, sizeof(data.binary.salt));
2602+ __set_errno(EINVAL);
2603+ return NULL;
2604+ }
2605+
2606+ BF_swap(data.binary.salt, 4);
2607+
2608+ BF_set_key(key, data.expanded_key, data.ctx.P);
2609+
2610+ memcpy(data.ctx.S, BF_init_state.S, sizeof(data.ctx.S));
2611+
2612+ L = R = 0;
2613+ for (i = 0; i < BF_N + 2; i += 2) {
2614+ L ^= data.binary.salt[i & 2];
2615+ R ^= data.binary.salt[(i & 2) + 1];
2616+ BF_ENCRYPT;
2617+ data.ctx.P[i] = L;
2618+ data.ctx.P[i + 1] = R;
2619+ }
2620+
2621+ ptr = data.ctx.S[0];
2622+ do {
2623+ ptr += 4;
2624+ L ^= data.binary.salt[(BF_N + 2) & 3];
2625+ R ^= data.binary.salt[(BF_N + 3) & 3];
2626+ BF_ENCRYPT;
2627+ *(ptr - 4) = L;
2628+ *(ptr - 3) = R;
2629+
2630+ L ^= data.binary.salt[(BF_N + 4) & 3];
2631+ R ^= data.binary.salt[(BF_N + 5) & 3];
2632+ BF_ENCRYPT;
2633+ *(ptr - 2) = L;
2634+ *(ptr - 1) = R;
2635+ } while (ptr < &data.ctx.S[3][0xFF]);
2636+
2637+ do {
2638+ data.ctx.P[0] ^= data.expanded_key[0];
2639+ data.ctx.P[1] ^= data.expanded_key[1];
2640+ data.ctx.P[2] ^= data.expanded_key[2];
2641+ data.ctx.P[3] ^= data.expanded_key[3];
2642+ data.ctx.P[4] ^= data.expanded_key[4];
2643+ data.ctx.P[5] ^= data.expanded_key[5];
2644+ data.ctx.P[6] ^= data.expanded_key[6];
2645+ data.ctx.P[7] ^= data.expanded_key[7];
2646+ data.ctx.P[8] ^= data.expanded_key[8];
2647+ data.ctx.P[9] ^= data.expanded_key[9];
2648+ data.ctx.P[10] ^= data.expanded_key[10];
2649+ data.ctx.P[11] ^= data.expanded_key[11];
2650+ data.ctx.P[12] ^= data.expanded_key[12];
2651+ data.ctx.P[13] ^= data.expanded_key[13];
2652+ data.ctx.P[14] ^= data.expanded_key[14];
2653+ data.ctx.P[15] ^= data.expanded_key[15];
2654+ data.ctx.P[16] ^= data.expanded_key[16];
2655+ data.ctx.P[17] ^= data.expanded_key[17];
2656+
2657+ BF_body();
2658+
2659+ tmp1 = data.binary.salt[0];
2660+ tmp2 = data.binary.salt[1];
2661+ tmp3 = data.binary.salt[2];
2662+ tmp4 = data.binary.salt[3];
2663+ data.ctx.P[0] ^= tmp1;
2664+ data.ctx.P[1] ^= tmp2;
2665+ data.ctx.P[2] ^= tmp3;
2666+ data.ctx.P[3] ^= tmp4;
2667+ data.ctx.P[4] ^= tmp1;
2668+ data.ctx.P[5] ^= tmp2;
2669+ data.ctx.P[6] ^= tmp3;
2670+ data.ctx.P[7] ^= tmp4;
2671+ data.ctx.P[8] ^= tmp1;
2672+ data.ctx.P[9] ^= tmp2;
2673+ data.ctx.P[10] ^= tmp3;
2674+ data.ctx.P[11] ^= tmp4;
2675+ data.ctx.P[12] ^= tmp1;
2676+ data.ctx.P[13] ^= tmp2;
2677+ data.ctx.P[14] ^= tmp3;
2678+ data.ctx.P[15] ^= tmp4;
2679+ data.ctx.P[16] ^= tmp1;
2680+ data.ctx.P[17] ^= tmp2;
2681+
2682+ BF_body();
2683+ } while (--count);
2684+
2685+ for (i = 0; i < 6; i += 2) {
2686+ L = BF_magic_w[i];
2687+ R = BF_magic_w[i + 1];
2688+
2689+ count = 64;
2690+ do {
2691+ BF_ENCRYPT;
2692+ } while (--count);
2693+
2694+ data.binary.output[i] = L;
2695+ data.binary.output[i + 1] = R;
2696+ }
2697+
2698+ memcpy(output, setting, 7 + 22 - 1);
2699+ output[7 + 22 - 1] = BF_itoa64[(int)
2700+ BF_atoi64[(int)setting[7 + 22 - 1] - 0x20] & 0x30];
2701+
2702+/* This has to be bug-compatible with the original implementation, so
2703+ * only encode 23 of the 24 bytes. :-) */
2704+ BF_swap(data.binary.output, 6);
2705+ BF_encode(&output[7 + 22], data.binary.output, 23);
2706+ output[7 + 22 + 31] = '\0';
2707+
2708+/* Overwrite the most obvious sensitive data we have on the stack. Note
2709+ * that this does not guarantee there's no sensitive data left on the
2710+ * stack and/or in registers; I'm not aware of portable code that does. */
2711+ clean(&data, sizeof(data));
2712+
2713+ return output;
2714+}
2715+
2716+char *_crypt_gensalt_blowfish_rn(unsigned long count,
2717+ __CONST char *input, int size, char *output, int output_size)
2718+{
2719+ if (size < 16 || output_size < 7 + 22 + 1 ||
2720+ (count && (count < 4 || count > 31))) {
2721+ if (output_size > 0) output[0] = '\0';
2722+ __set_errno((output_size < 7 + 22 + 1) ? ERANGE : EINVAL);
2723+ return NULL;
2724+ }
2725+
2726+ if (!count) count = 5;
2727+
2728+ output[0] = '$';
2729+ output[1] = '2';
2730+ output[2] = 'a';
2731+ output[3] = '$';
2732+ output[4] = '0' + count / 10;
2733+ output[5] = '0' + count % 10;
2734+ output[6] = '$';
2735+
2736+ BF_encode(&output[7], (BF_word *)input, 16);
2737+ output[7 + 22] = '\0';
2738+
2739+ return output;
2740+}
2741diff -Nura php-4.4.2/ext/standard/crypt.c hardening-patch-4.4.2-0.4.15/ext/standard/crypt.c
2742--- php-4.4.2/ext/standard/crypt.c 2006-01-01 14:46:57.000000000 +0100
2743+++ hardening-patch-4.4.2-0.4.15/ext/standard/crypt.c 2006-09-05 20:30:33.000000000 +0200
2744@@ -100,6 +100,8 @@
2745 return SUCCESS;
2746 }
2747
2748+char *_crypt_blowfish_rn(char *key, char *setting, char *output, int size);
2749+char *_crypt_gensalt_blowfish_rn(unsigned long count, char *input, int size, char *output, int output_size);
2750
2751 static unsigned char itoa64[] = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
2752
2753@@ -135,7 +137,14 @@
2754
2755 /* The automatic salt generation only covers standard DES and md5-crypt */
2756 if(!*salt) {
2757-#if PHP_MD5_CRYPT
2758+#if PHP_BLOWFISH_CRYPT
2759+ char randat[16];
2760+ int i;
2761+
2762+ for (i=0; i<16; i++) randat[i] = PHP_CRYPT_RAND;
2763+
2764+ _crypt_gensalt_blowfish_rn(5, randat, sizeof(randat), salt, sizeof(salt));
2765+#elif PHP_MD5_CRYPT
2766 strcpy(salt, "$1$");
2767 php_to64(&salt[3], PHP_CRYPT_RAND, 4);
2768 php_to64(&salt[7], PHP_CRYPT_RAND, 4);
2769@@ -145,8 +154,24 @@
2770 salt[2] = '\0';
2771 #endif
2772 }
2773-
2774- RETVAL_STRING(crypt(str, salt), 1);
2775+
2776+ if (salt[0] == '$' &&
2777+ salt[1] == '2' &&
2778+ salt[2] == 'a' &&
2779+ salt[3] == '$' &&
2780+ salt[4] >= '0' && salt[4] <= '3' &&
2781+ salt[5] >= '0' && salt[5] <= '9' &&
2782+ salt[6] == '$') {
2783+
2784+ char output[PHP_MAX_SALT_LEN+1];
2785+
2786+ output[0] = 0;
2787+ _crypt_blowfish_rn(str, salt, output, sizeof(output));
2788+ RETVAL_STRING(output, 1);
2789+
2790+ } else {
2791+ RETVAL_STRING(crypt(str, salt), 1);
2792+ }
2793 }
2794 /* }}} */
2795 #endif
2796diff -Nura php-4.4.2/ext/standard/dl.c hardening-patch-4.4.2-0.4.15/ext/standard/dl.c
2797--- php-4.4.2/ext/standard/dl.c 2006-01-01 14:46:57.000000000 +0100
2798+++ hardening-patch-4.4.2-0.4.15/ext/standard/dl.c 2006-09-05 20:30:33.000000000 +0200
2799@@ -160,8 +160,35 @@
2800 RETURN_FALSE;
2801 }
2802 module_entry = get_module();
2803+
2804+ /* check if Hardening-Patch is installed */
2805+ if (module_entry->zend_api < 1000000000) {
2806+ php_error_docref(NULL TSRMLS_CC, error_type,
2807+ "%s: Unable to initialize module\n"
2808+ "Module compiled without Hardening-Patch, module API=%d, debug=%d, thread-safety=%d\n"
2809+ "PHP compiled with Hardening-Patch=%d, module API=%d, debug=%d, thread-safety=%d\n"
2810+ "These options need to match\n",
2811+ module_entry->name, module_entry->zend_api, module_entry->zend_debug, module_entry->zts,
2812+ HARDENING_PATCH_ZEND_MODULE_API_NO, ZEND_MODULE_API_NO, ZEND_DEBUG, USING_ZTS);
2813+ DL_UNLOAD(handle);
2814+ RETURN_FALSE;
2815+ }
2816+
2817+ /* check if correct Hardening-Patch is installed */
2818+ if (module_entry->zend_api != HARDENING_PATCH_ZEND_MODULE_API_NO) {
2819+ php_error_docref(NULL TSRMLS_CC, error_type,
2820+ "%s: Unable to initialize module\n"
2821+ "Module compiled with Hardening-Patch=%d, module API=%d, debug=%d, thread-safety=%d\n"
2822+ "PHP compiled with Hardening-Patch=%d, module API=%d, debug=%d, thread-safety=%d\n"
2823+ "These options need to match\n",
2824+ module_entry->name, module_entry->zend_api, module_entry->real_zend_api, module_entry->zend_debug, module_entry->zts,
2825+ HARDENING_PATCH_ZEND_MODULE_API_NO, ZEND_MODULE_API_NO, ZEND_DEBUG, USING_ZTS);
2826+ DL_UNLOAD(handle);
2827+ RETURN_FALSE;
2828+ }
2829+
2830 if ((module_entry->zend_debug != ZEND_DEBUG) || (module_entry->zts != USING_ZTS)
2831- || (module_entry->zend_api != ZEND_MODULE_API_NO)) {
2832+ || (module_entry->real_zend_api != ZEND_MODULE_API_NO)) {
2833 /* Check for pre-4.1.0 module which has a slightly different module_entry structure :( */
2834 struct pre_4_1_0_module_entry {
2835 char *name;
2836@@ -195,7 +222,7 @@
2837 zts = ((struct pre_4_1_0_module_entry *)module_entry)->zts;
2838 } else {
2839 name = module_entry->name;
2840- zend_api = module_entry->zend_api;
2841+ zend_api = module_entry->real_zend_api;
2842 zend_debug = module_entry->zend_debug;
2843 zts = module_entry->zts;
2844 }
2845diff -Nura php-4.4.2/ext/standard/file.c hardening-patch-4.4.2-0.4.15/ext/standard/file.c
2846--- php-4.4.2/ext/standard/file.c 2006-01-01 14:46:57.000000000 +0100
2847+++ hardening-patch-4.4.2-0.4.15/ext/standard/file.c 2006-09-05 20:30:33.000000000 +0200
2848@@ -21,7 +21,7 @@
2849 +----------------------------------------------------------------------+
2850 */
2851
2852-/* $Id: file.c,v 1.279.2.70.2.3 2006/01/01 13:46:57 sniper Exp $ */
2853+/* $Id: file.c,v 1.279.2.70.2.7 2006/04/14 17:46:59 pollita Exp $ */
2854
2855 /* Synced with php 3.0 revision 1.218 1999-06-16 [ssb] */
2856
2857@@ -552,7 +552,7 @@
2858 pval **arg1, **arg2;
2859 char *d;
2860 char *opened_path;
2861- char p[64];
2862+ char *p;
2863 FILE *fp;
2864
2865 if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) {
2866@@ -566,7 +566,11 @@
2867 }
2868
2869 d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1));
2870- strlcpy(p, Z_STRVAL_PP(arg2), sizeof(p));
2871+
2872+ p = php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0);
2873+ if (strlen(p) > 64) {
2874+ p[63] = '\0';
2875+ }
2876
2877 if ((fp = php_open_temporary_file(d, p, &opened_path TSRMLS_CC))) {
2878 fclose(fp);
2879@@ -574,6 +578,7 @@
2880 } else {
2881 RETVAL_FALSE;
2882 }
2883+ efree(p);
2884 efree(d);
2885 }
2886 /* }}} */
2887@@ -819,7 +824,7 @@
2888
2889 /* If seconds is not set to null, build the timeval, else we wait indefinitely */
2890 if (sec != NULL) {
2891- convert_to_long_ex(&sec);
2892+ convert_to_long(sec);
2893
2894 if (usec > 999999) {
2895 tv.tv_sec = Z_LVAL_P(sec) + (usec / 1000000);
2896@@ -2196,7 +2201,7 @@
2897 safe_to_copy:
2898
2899 srcstream = php_stream_open_wrapper(src, "rb",
2900- STREAM_DISABLE_OPEN_BASEDIR | REPORT_ERRORS,
2901+ ENFORCE_SAFE_MODE | REPORT_ERRORS,
2902 NULL);
2903
2904 if (!srcstream)
2905@@ -2522,7 +2527,7 @@
2906 #if (!defined(__BEOS__) && !defined(NETWARE) && HAVE_REALPATH) || defined(ZTS)
2907 /* {{{ proto string realpath(string path)
2908 Return the resolved path */
2909-PHP_FUNCTION(realpath)
2910+PHP_FUNCTION(real_path)
2911 {
2912 zval **path;
2913 char resolved_path_buff[MAXPATHLEN];
2914diff -Nura php-4.4.2/ext/standard/file.h hardening-patch-4.4.2-0.4.15/ext/standard/file.h
2915--- php-4.4.2/ext/standard/file.h 2006-01-01 14:46:57.000000000 +0100
2916+++ hardening-patch-4.4.2-0.4.15/ext/standard/file.h 2006-09-05 20:30:33.000000000 +0200
2917@@ -64,7 +64,7 @@
2918 PHP_FUNCTION(fd_set);
2919 PHP_FUNCTION(fd_isset);
2920 #if (!defined(__BEOS__) && !defined(NETWARE) && HAVE_REALPATH) || defined(ZTS)
2921-PHP_FUNCTION(realpath);
2922+PHP_FUNCTION(real_path);
2923 #endif
2924 #ifdef HAVE_FNMATCH
2925 PHP_FUNCTION(fnmatch);
2926diff -Nura php-4.4.2/ext/standard/head.c hardening-patch-4.4.2-0.4.15/ext/standard/head.c
2927--- php-4.4.2/ext/standard/head.c 2006-01-01 14:46:57.000000000 +0100
2928+++ hardening-patch-4.4.2-0.4.15/ext/standard/head.c 2006-09-05 20:30:33.000000000 +0200
2929@@ -44,7 +44,7 @@
2930 if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|bl", &ctr.line,
2931 &ctr.line_len, &rep, &ctr.response_code) == FAILURE)
2932 return;
2933-
2934+
2935 sapi_header_op(rep ? SAPI_HEADER_REPLACE:SAPI_HEADER_ADD, &ctr TSRMLS_CC);
2936 }
2937 /* }}} */
2938diff -Nura php-4.4.2/ext/standard/html.c hardening-patch-4.4.2-0.4.15/ext/standard/html.c
2939--- php-4.4.2/ext/standard/html.c 2006-01-01 14:46:57.000000000 +0100
2940+++ hardening-patch-4.4.2-0.4.15/ext/standard/html.c 2006-09-05 20:30:33.000000000 +0200
2941@@ -18,7 +18,7 @@
2942 +----------------------------------------------------------------------+
2943 */
2944
2945-/* $Id: html.c,v 1.63.2.23.2.1 2006/01/01 13:46:57 sniper Exp $ */
2946+/* $Id: html.c,v 1.63.2.23.2.2 2006/02/25 21:33:06 rasmus Exp $ */
2947
2948 /*
2949 * HTML entity resources:
2950@@ -793,7 +793,7 @@
2951 enum entity_charset charset = determine_charset(hint_charset TSRMLS_CC);
2952 unsigned char replacement[15];
2953
2954- ret = estrdup(old);
2955+ ret = estrndup(old, oldlen);
2956 retlen = oldlen;
2957 if (!retlen) {
2958 goto empty_source;
2959diff -Nura php-4.4.2/ext/standard/http_fopen_wrapper.c hardening-patch-4.4.2-0.4.15/ext/standard/http_fopen_wrapper.c
2960--- php-4.4.2/ext/standard/http_fopen_wrapper.c 2006-01-01 14:46:57.000000000 +0100
2961+++ hardening-patch-4.4.2-0.4.15/ext/standard/http_fopen_wrapper.c 2006-09-05 20:30:33.000000000 +0200
2962@@ -18,7 +18,7 @@
2963 | Wez Furlong <wez@thebrainroom.com> |
2964 +----------------------------------------------------------------------+
2965 */
2966-/* $Id: http_fopen_wrapper.c,v 1.53.2.20.2.5 2006/01/01 13:46:57 sniper Exp $ */
2967+/* $Id: http_fopen_wrapper.c,v 1.53.2.20.2.9 2006/04/16 17:45:55 iliaa Exp $ */
2968
2969 #include "php.h"
2970 #include "php_globals.h"
2971@@ -339,7 +339,7 @@
2972 size_t tmp_line_len;
2973 /* get response header */
2974
2975- if (_php_stream_get_line(stream, tmp_line, sizeof(tmp_line) - 1, &tmp_line_len TSRMLS_CC) != NULL) {
2976+ if (php_stream_get_line(stream, tmp_line, sizeof(tmp_line) - 1, &tmp_line_len) != NULL) {
2977 zval *http_response;
2978 int response_code;
2979
2980@@ -353,6 +353,7 @@
2981 }
2982 switch(response_code) {
2983 case 200:
2984+ case 206: /* partial content */
2985 case 302:
2986 case 301:
2987 reqok = 1;
2988@@ -394,7 +395,7 @@
2989
2990 while (!body && !php_stream_eof(stream)) {
2991 size_t http_header_line_length;
2992- if (php_stream_get_line(stream, http_header_line, HTTP_HEADER_BLOCK_SIZE, &http_header_line_length TSRMLS_CC) && *http_header_line != '\n' && *http_header_line != '\r') {
2993+ if (php_stream_get_line(stream, http_header_line, HTTP_HEADER_BLOCK_SIZE, &http_header_line_length) && *http_header_line != '\n' && *http_header_line != '\r') {
2994 char *e = http_header_line + http_header_line_length - 1;
2995 while (*e == '\n' || *e == '\r') {
2996 e--;
2997@@ -502,9 +503,11 @@
2998 } \
2999 } \
3000 /* check for control characters in login, password & path */
3001- CHECK_FOR_CNTRL_CHARS(resource->user)
3002- CHECK_FOR_CNTRL_CHARS(resource->pass)
3003- CHECK_FOR_CNTRL_CHARS(resource->path)
3004+ if (strncasecmp(new_path, "http://", sizeof("http://") - 1) || strncasecmp(new_path, "https://", sizeof("https://") - 1)) {
3005+ CHECK_FOR_CNTRL_CHARS(resource->user)
3006+ CHECK_FOR_CNTRL_CHARS(resource->pass)
3007+ CHECK_FOR_CNTRL_CHARS(resource->path)
3008+ }
3009
3010 stream = php_stream_url_wrap_http_ex(NULL, new_path, mode, options, opened_path, context, --redirect_max, 0 STREAMS_CC TSRMLS_CC);
3011 if (stream && stream->wrapperdata) {
3012diff -Nura php-4.4.2/ext/standard/info.c hardening-patch-4.4.2-0.4.15/ext/standard/info.c
3013--- php-4.4.2/ext/standard/info.c 2006-01-01 14:46:57.000000000 +0100
3014+++ hardening-patch-4.4.2-0.4.15/ext/standard/info.c 2006-09-05 20:30:33.000000000 +0200
3015@@ -18,7 +18,7 @@
3016 +----------------------------------------------------------------------+
3017 */
3018
3019-/* $Id: info.c,v 1.218.2.18.2.6 2006/01/01 13:46:57 sniper Exp $ */
3020+/* $Id: info.c,v 1.218.2.18.2.7 2006/06/28 13:12:09 derick Exp $ */
3021
3022 #include "php.h"
3023 #include "php_ini.h"
3024@@ -58,6 +58,23 @@
3025
3026 PHPAPI extern char *php_ini_opened_path;
3027 PHPAPI extern char *php_ini_scanned_files;
3028+
3029+static int php_info_write_wrapper(const char *str, uint str_length)
3030+{
3031+ int new_len, written;
3032+ char *elem_esc;
3033+
3034+ TSRMLS_FETCH();
3035+
3036+ elem_esc = php_escape_html_entities((char *)str, str_length, &new_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
3037+
3038+ written = php_body_write(elem_esc, new_len TSRMLS_CC);
3039+
3040+ efree(elem_esc);
3041+
3042+ return written;
3043+}
3044+
3045
3046 /* {{{ _display_module_info
3047 */
3048@@ -133,23 +150,12 @@
3049 PUTS(" => ");
3050 }
3051 if (Z_TYPE_PP(tmp) == IS_ARRAY) {
3052- zval *tmp3;
3053- MAKE_STD_ZVAL(tmp3);
3054 if (!sapi_module.phpinfo_as_text) {
3055 PUTS("<pre>");
3056- }
3057- php_start_ob_buffer(NULL, 4096, 1 TSRMLS_CC);
3058- zend_print_zval_r(*tmp, 0);
3059- php_ob_get_buffer(tmp3 TSRMLS_CC);
3060- php_end_ob_buffer(0, 0 TSRMLS_CC);
3061-
3062- elem_esc = php_info_html_esc(Z_STRVAL_P(tmp3) TSRMLS_CC);
3063- PUTS(elem_esc);
3064- efree(elem_esc);
3065- zval_ptr_dtor(&tmp3);
3066-
3067- if (!sapi_module.phpinfo_as_text) {
3068+ zend_print_zval_r_ex((zend_write_func_t) php_info_write_wrapper, *tmp, 0);
3069 PUTS("</pre>");
3070+ } else {
3071+ zend_print_zval_r(*tmp, 0);
3072 }
3073 } else if (Z_TYPE_PP(tmp) != IS_STRING) {
3074 tmp2 = **tmp;
3075@@ -408,7 +414,7 @@
3076
3077 if (flag & PHP_INFO_GENERAL) {
3078 char *zend_version = get_zend_version();
3079- char temp_api[9];
3080+ char temp_api[11];
3081
3082 php_uname = php_get_uname('a');
3083
3084@@ -430,11 +436,22 @@
3085 }
3086 }
3087
3088+#if HARDENING_PATCH
3089+ if (!sapi_module.phpinfo_as_text) {
3090+ php_printf("<h1 class=\"p\">PHP Version %s with <a href=\"http://www.hardened-php.net\">Hardening-Patch</a> %s</h1>\n", PHP_VERSION, HARDENING_PATCH_VERSION);
3091+ } else {
3092+ char temp_ver[40];
3093+
3094+ snprintf(temp_ver, sizeof(temp_ver), "%s/%s", PHP_VERSION, HARDENING_PATCH_VERSION);
3095+ php_info_print_table_row(2, "PHP/Hardening-Patch Version", temp_ver);
3096+ }
3097+#else
3098 if (!sapi_module.phpinfo_as_text) {
3099 php_printf("<h1 class=\"p\">PHP Version %s</h1>\n", PHP_VERSION);
3100 } else {
3101 php_info_print_table_row(2, "PHP Version", PHP_VERSION);
3102 }
3103+#endif
3104 php_info_print_box_end();
3105 php_info_print_table_start();
3106 php_info_print_table_row(2, "System", php_uname );
3107diff -Nura php-4.4.2/ext/standard/mail.c hardening-patch-4.4.2-0.4.15/ext/standard/mail.c
3108--- php-4.4.2/ext/standard/mail.c 2006-01-01 14:46:57.000000000 +0100
3109+++ hardening-patch-4.4.2-0.4.15/ext/standard/mail.c 2006-09-05 20:30:33.000000000 +0200
3110@@ -78,6 +78,25 @@
3111 }
3112 /* }}} */
3113
3114+/* {{{ hphp_strcasestr */
3115+char *hphp_strcasestr(char *haystack, char *needle)
3116+{
3117+ unsigned char *t, *h, *n;
3118+
3119+ h = (unsigned char *) haystack;
3120+conts:
3121+ while (*h) {
3122+ n = (unsigned char *) needle;
3123+ for (t=h++; *n && *h; t++, n++) {
3124+ if (toupper(*t) != toupper(*n)) goto conts;
3125+ }
3126+ return ((char*)h-1);
3127+ }
3128+
3129+ return (NULL);
3130+}
3131+/* }}} */
3132+
3133 /* {{{ proto int mail(string to, string subject, string message [, string additional_headers [, string additional_parameters]])
3134 Send an email message */
3135 PHP_FUNCTION(mail)
3136@@ -103,6 +122,44 @@
3137 return;
3138 }
3139
3140+ if (HG(hphp_mailprotect) > 0) {
3141+ if (headers_len > 0 && headers && (strstr(headers,"\n\n") || strstr(headers,"\r\n\r\n")) ) {
3142+ php_security_log(S_MAIL, "mail() - double newline in headers, possible injection, mail dropped");
3143+ RETURN_FALSE;
3144+ }
3145+
3146+ /* check for spam attempts with buggy webforms */
3147+ if (to_len > 0 && to && (strchr(to, '\n') != NULL || strchr(to, '\r') != NULL)) {
3148+ php_security_log(S_MAIL, "mail() - newline in to header, possible injection, mail dropped");
3149+ RETURN_FALSE;
3150+ }
3151+
3152+ if (subject_len > 0 && subject && (strchr(subject, '\n') != NULL || strchr(subject, '\r') != NULL)) {
3153+ php_security_log(S_MAIL, "mail() - newline subject header, possible injection, mail dropped");
3154+ RETURN_FALSE;
3155+ }
3156+
3157+ if (HG(hphp_mailprotect) > 1) {
3158+ /* search for to, cc or bcc headers */
3159+ if (headers_len > 0 && headers != NULL) {
3160+ if (strncasecmp(headers, "to:", sizeof("to:") - 1) == 0 || hphp_strcasestr(headers, "\nto:")) {
3161+ php_security_log(S_MAIL, "mail() - To: headers aren't allowed in the headers parameter.");
3162+ RETURN_FALSE;
3163+ }
3164+
3165+ if (strncasecmp(headers, "cc:", sizeof("cc:") - 1) == 0 || hphp_strcasestr(headers, "\ncc:")) {
3166+ php_security_log(S_MAIL, "mail() - CC: headers aren't allowed in the headers parameter.");
3167+ RETURN_FALSE;
3168+ }
3169+
3170+ if (strncasecmp(headers, "bcc:", sizeof("bcc:") - 1) == 0 || hphp_strcasestr(headers, "\nbcc:")) {
3171+ php_security_log(S_MAIL, "mail() - BCC: headers aren't allowed in the headers parameter.");
3172+ RETURN_FALSE;
3173+ }
3174+ }
3175+ }
3176+ }
3177+
3178 if (to_len > 0) {
3179 to_r = estrndup(to, to_len);
3180 for (; to_len; to_len--) {
3181diff -Nura php-4.4.2/ext/standard/pack.c hardening-patch-4.4.2-0.4.15/ext/standard/pack.c
3182--- php-4.4.2/ext/standard/pack.c 2006-01-01 14:46:57.000000000 +0100
3183+++ hardening-patch-4.4.2-0.4.15/ext/standard/pack.c 2006-09-05 20:30:33.000000000 +0200
3184@@ -15,7 +15,7 @@
3185 | Author: Chris Schneider <cschneid@relog.ch> |
3186 +----------------------------------------------------------------------+
3187 */
3188-/* $Id: pack.c,v 1.40.2.7.2.4 2006/01/01 13:46:57 sniper Exp $ */
3189+/* $Id: pack.c,v 1.40.2.7.2.5 2006/01/26 15:47:31 iliaa Exp $ */
3190
3191 #include "php.h"
3192
3193@@ -693,7 +693,9 @@
3194 len = size * 2;
3195 }
3196
3197- len -= argb % 2;
3198+ if (argb > 0) {
3199+ len -= argb % 2;
3200+ }
3201
3202 buf = emalloc(len + 1);
3203
3204diff -Nura php-4.4.2/ext/standard/php_standard.h hardening-patch-4.4.2-0.4.15/ext/standard/php_standard.h
3205--- php-4.4.2/ext/standard/php_standard.h 2006-01-01 14:46:58.000000000 +0100
3206+++ hardening-patch-4.4.2-0.4.15/ext/standard/php_standard.h 2006-09-05 20:30:33.000000000 +0200
3207@@ -28,6 +28,7 @@
3208 #include "php_mail.h"
3209 #include "md5.h"
3210 #include "sha1.h"
3211+#include "sha256.h"
3212 #include "html.h"
3213 #include "exec.h"
3214 #include "file.h"
3215diff -Nura php-4.4.2/ext/standard/scanf.c hardening-patch-4.4.2-0.4.15/ext/standard/scanf.c
3216--- php-4.4.2/ext/standard/scanf.c 2006-01-01 14:46:58.000000000 +0100
3217+++ hardening-patch-4.4.2-0.4.15/ext/standard/scanf.c 2006-09-05 20:30:33.000000000 +0200
3218@@ -16,7 +16,7 @@
3219 +----------------------------------------------------------------------+
3220 */
3221
3222-/* $Id: scanf.c,v 1.16.4.9.2.1 2006/01/01 13:46:58 sniper Exp $ */
3223+/* $Id: scanf.c,v 1.16.4.9.2.2 2006/08/04 11:59:50 tony2001 Exp $ */
3224
3225 /*
3226 scanf.c --
3227@@ -732,7 +732,7 @@
3228 if (*end == '$') {
3229 format = end+1;
3230 ch = format++;
3231- objIndex = varStart + value;
3232+ objIndex = varStart + value - 1;
3233 }
3234 }
3235
3236@@ -762,8 +762,10 @@
3237 switch (*ch) {
3238 case 'n':
3239 if (!(flags & SCAN_SUPPRESS)) {
3240- if (numVars) {
3241- current = args[objIndex++];
3242+ if (numVars && objIndex >= argCount) {
3243+ break;
3244+ } else if (numVars) {
3245+ current = args[objIndex++];
3246 zval_dtor( *current );
3247 ZVAL_LONG( *current, (long)(string - baseString) );
3248 } else {
3249@@ -883,8 +885,10 @@
3250 }
3251 }
3252 if (!(flags & SCAN_SUPPRESS)) {
3253- if (numVars) {
3254- current = args[objIndex++];
3255+ if (numVars && objIndex >= argCount) {
3256+ break;
3257+ } else if (numVars) {
3258+ current = args[objIndex++];
3259 zval_dtor( *current );
3260 ZVAL_STRINGL( *current, string, end-string, 1);
3261 } else {
3262@@ -922,7 +926,9 @@
3263 goto done;
3264 }
3265 if (!(flags & SCAN_SUPPRESS)) {
3266- if (numVars) {
3267+ if (numVars && objIndex >= argCount) {
3268+ break;
3269+ } else if (numVars) {
3270 current = args[objIndex++];
3271 zval_dtor( *current );
3272 ZVAL_STRINGL( *current, string, end-string, 1);
3273@@ -1079,8 +1085,10 @@
3274 value = (int) (*fn)(buf, NULL, base);
3275 if ((flags & SCAN_UNSIGNED) && (value < 0)) {
3276 sprintf(buf, "%u", value); /* INTL: ISO digit */
3277- if (numVars) {
3278- /* change passed value type to string */
3279+ if (numVars && objIndex >= argCount) {
3280+ break;
3281+ } else if (numVars) {
3282+ /* change passed value type to string */
3283 current = args[objIndex++];
3284 convert_to_string( *current );
3285 ZVAL_STRING( *current, buf, 1 );
3286@@ -1088,7 +1096,9 @@
3287 add_index_string(*return_value, objIndex++, buf, 1);
3288 }
3289 } else {
3290- if (numVars) {
3291+ if (numVars && objIndex >= argCount) {
3292+ break;
3293+ } else if (numVars) {
3294 current = args[objIndex++];
3295 convert_to_long( *current );
3296 Z_LVAL(**current) = value;
3297@@ -1196,7 +1206,9 @@
3298 double dvalue;
3299 *end = '\0';
3300 dvalue = zend_strtod(buf, NULL);
3301- if (numVars) {
3302+ if (numVars && objIndex >= argCount) {
3303+ break;
3304+ } else if (numVars) {
3305 current = args[objIndex++];
3306 convert_to_double( *current );
3307 Z_DVAL_PP( current ) = dvalue;
3308diff -Nura php-4.4.2/ext/standard/sha256.c hardening-patch-4.4.2-0.4.15/ext/standard/sha256.c
3309--- php-4.4.2/ext/standard/sha256.c 1970-01-01 01:00:00.000000000 +0100
3310+++ hardening-patch-4.4.2-0.4.15/ext/standard/sha256.c 2006-09-05 20:30:33.000000000 +0200
3311@@ -0,0 +1,398 @@
3312+/*
3313+ +----------------------------------------------------------------------+
3314+ | PHP Version 5 |
3315+ +----------------------------------------------------------------------+
3316+ | Copyright (c) 1997-2004 The PHP Group |
3317+ +----------------------------------------------------------------------+
3318+ | This source file is subject to version 3.0 of the PHP license, |
3319+ | that is bundled with this package in the file LICENSE, and is |
3320+ | available through the world-wide-web at the following url: |
3321+ | http://www.php.net/license/3_0.txt. |
3322+ | If you did not receive a copy of the PHP license and are unable to |
3323+ | obtain it through the world-wide-web, please send a note to |
3324+ | license@php.net so we can mail you a copy immediately. |
3325+ +----------------------------------------------------------------------+
3326+ | Author: Stefan Esser <sesser@php.net> |
3327+ +----------------------------------------------------------------------+
3328+*/
3329+
3330+/* $Id: sha256.c,v 1.9 2004/01/08 08:17:34 andi Exp $ */
3331+
3332+#include <stdio.h>
3333+#include "php.h"
3334+
3335+/* This code is heavily based on the PHP md5/sha1 implementations */
3336+
3337+#include "sha256.h"
3338+
3339+PHPAPI void make_sha256_digest(char *sha256str, unsigned char *digest)
3340+{
3341+ int i;
3342+
3343+ for (i = 0; i < 32; i++) {
3344+ sprintf(sha256str, "%02x", digest[i]);
3345+ sha256str += 2;
3346+ }
3347+
3348+ *sha256str = '\0';
3349+}
3350+
3351+/* {{{ proto string sha256(string str [, bool raw_output])
3352+ Calculate the sha256 hash of a string */
3353+PHP_FUNCTION(sha256)
3354+{
3355+ char *arg;
3356+ int arg_len;
3357+ zend_bool raw_output = 0;
3358+ char sha256str[65];
3359+ PHP_SHA256_CTX context;
3360+ unsigned char digest[32];
3361+
3362+ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &arg, &arg_len, &raw_output) == FAILURE) {
3363+ return;
3364+ }
3365+
3366+ sha256str[0] = '\0';
3367+ PHP_SHA256Init(&context);
3368+ PHP_SHA256Update(&context, arg, arg_len);
3369+ PHP_SHA256Final(digest, &context);
3370+ if (raw_output) {
3371+ RETURN_STRINGL(digest, 32, 1);
3372+ } else {
3373+ make_sha256_digest(sha256str, digest);
3374+ RETVAL_STRING(sha256str, 1);
3375+ }
3376+
3377+}
3378+
3379+/* }}} */
3380+
3381+/* {{{ proto string sha256_file(string filename [, bool raw_output])
3382+ Calculate the sha256 hash of given filename */
3383+PHP_FUNCTION(sha256_file)
3384+{
3385+ char *arg;
3386+ int arg_len;
3387+ zend_bool raw_output = 0;
3388+ char sha256str[65];
3389+ unsigned char buf[1024];
3390+ unsigned char digest[32];
3391+ PHP_SHA256_CTX context;
3392+ int n;
3393+ FILE *fp;
3394+
3395+ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &arg, &arg_len, &raw_output) == FAILURE) {
3396+ return;
3397+ }
3398+
3399+ if (PG(safe_mode) && (!php_checkuid(arg, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
3400+ RETURN_FALSE;
3401+ }
3402+
3403+ if (php_check_open_basedir(arg TSRMLS_CC)) {
3404+ RETURN_FALSE;
3405+ }
3406+
3407+ if ((fp = VCWD_FOPEN(arg, "rb")) == NULL) {
3408+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open file");
3409+ RETURN_FALSE;
3410+ }
3411+
3412+ PHP_SHA256Init(&context);
3413+
3414+ while ((n = fread(buf, 1, sizeof(buf), fp)) > 0) {
3415+ PHP_SHA256Update(&context, buf, n);
3416+ }
3417+
3418+ PHP_SHA256Final(digest, &context);
3419+
3420+ if (ferror(fp)) {
3421+ fclose(fp);
3422+ RETURN_FALSE;
3423+ }
3424+
3425+ fclose(fp);
3426+
3427+ if (raw_output) {
3428+ RETURN_STRINGL(digest, 32, 1);
3429+ } else {
3430+ make_sha256_digest(sha256str, digest);
3431+ RETVAL_STRING(sha256str, 1);
3432+ }
3433+}
3434+/* }}} */
3435+
3436+
3437+static void SHA256Transform(php_uint32[8], const unsigned char[64]);
3438+static void SHA256Encode(unsigned char *, php_uint32 *, unsigned int);
3439+static void SHA256Decode(php_uint32 *, const unsigned char *, unsigned int);
3440+
3441+static unsigned char PADDING[64] =
3442+{
3443+ 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
3444+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
3445+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
3446+};
3447+
3448+/* F, G, H and I are basic SHA256 functions.
3449+ */
3450+#define F(x) (ROTATE_RIGHT(x,2) ^ ROTATE_RIGHT(x,13) ^ ROTATE_RIGHT(x,22))
3451+#define G(x, y, z) (((x) & (y)) | ((z) & ((y) | (x))))
3452+#define H(x) (ROTATE_RIGHT(x,6) ^ ROTATE_RIGHT(x,11) ^ ROTATE_RIGHT(x,25))
3453+#define I(x, y, z) (((x) & (y)) | ((~x) & z))
3454+
3455+/* ROTATE_RIGHT rotates x right n bits.
3456+ */
3457+#define ROTATE_RIGHT(x, n) (((x) >> (n)) | ((x) << (32-(n))))
3458+
3459+/* W[i]
3460+ */
3461+#define W(i) ( tmp1=ROTATE_RIGHT(x[(i-15)&15],7)^ROTATE_RIGHT(x[(i-15)&15],18)^(x[(i-15)&15] >> 3), \
3462+ tmp2=ROTATE_RIGHT(x[(i-2)&15],17)^ROTATE_RIGHT(x[(i-2)&15],19)^(x[(i-2)&15] >> 10), \
3463+ (x[i&15]=x[i&15] + tmp1 + x[(i-7)&15] + tmp2) )
3464+
3465+/* ROUND function of sha256
3466+ */
3467+
3468+#define ROUND(a,b,c,d,e,f,g,h,w,k) { \
3469+ t1 = (h) + H((e)) + I((e), (f), (g)) + (k) + (php_uint32)(w); \
3470+ (h) = F((a)) + G((a), (b), (c)) + t1; \
3471+ (d) += t1; \
3472+ }
3473+
3474+
3475+/* {{{ PHP_SHA256Init
3476+ * SHA256 initialization. Begins an SHA256 operation, writing a new context.
3477+ */
3478+PHPAPI void PHP_SHA256Init(PHP_SHA256_CTX * context)
3479+{
3480+ context->count[0] = context->count[1] = 0;
3481+ /* Load magic initialization constants.
3482+ */
3483+ context->state[0] = 0x6a09e667;
3484+ context->state[1] = 0xbb67ae85;
3485+ context->state[2] = 0x3c6ef372;
3486+ context->state[3] = 0xa54ff53a;
3487+ context->state[4] = 0x510e527f;
3488+ context->state[5] = 0x9b05688c;
3489+ context->state[6] = 0x1f83d9ab;
3490+ context->state[7] = 0x5be0cd19;
3491+}
3492+/* }}} */
3493+
3494+/* {{{ PHP_SHA256Update
3495+ SHA256 block update operation. Continues an SHA256 message-digest
3496+ operation, processing another message block, and updating the
3497+ context.
3498+ */
3499+PHPAPI void PHP_SHA256Update(PHP_SHA256_CTX * context, const unsigned char *input,
3500+ unsigned int inputLen)
3501+{
3502+ unsigned int i, index, partLen;
3503+
3504+ /* Compute number of bytes mod 64 */
3505+ index = (unsigned int) ((context->count[0] >> 3) & 0x3F);
3506+
3507+ /* Update number of bits */
3508+ if ((context->count[0] += ((php_uint32) inputLen << 3))
3509+ < ((php_uint32) inputLen << 3))
3510+ context->count[1]++;
3511+ context->count[1] += ((php_uint32) inputLen >> 29);
3512+
3513+ partLen = 64 - index;
3514+
3515+ /* Transform as many times as possible.
3516+ */
3517+ if (inputLen >= partLen) {
3518+ memcpy
3519+ ((unsigned char*) & context->buffer[index], (unsigned char*) input, partLen);
3520+ SHA256Transform(context->state, context->buffer);
3521+
3522+ for (i = partLen; i + 63 < inputLen; i += 64)
3523+ SHA256Transform(context->state, &input[i]);
3524+
3525+ index = 0;
3526+ } else
3527+ i = 0;
3528+
3529+ /* Buffer remaining input */
3530+ memcpy
3531+ ((unsigned char*) & context->buffer[index], (unsigned char*) & input[i],
3532+ inputLen - i);
3533+}
3534+/* }}} */
3535+
3536+/* {{{ PHP_SHA256Final
3537+ SHA256 finalization. Ends an SHA256 message-digest operation, writing the
3538+ the message digest and zeroizing the context.
3539+ */
3540+PHPAPI void PHP_SHA256Final(unsigned char digest[32], PHP_SHA256_CTX * context)
3541+{
3542+ unsigned char bits[8];
3543+ unsigned int index, padLen;
3544+
3545+ /* Save number of bits */
3546+ bits[7] = context->count[0] & 0xFF;
3547+ bits[6] = (context->count[0] >> 8) & 0xFF;
3548+ bits[5] = (context->count[0] >> 16) & 0xFF;
3549+ bits[4] = (context->count[0] >> 24) & 0xFF;
3550+ bits[3] = context->count[1] & 0xFF;
3551+ bits[2] = (context->count[1] >> 8) & 0xFF;
3552+ bits[1] = (context->count[1] >> 16) & 0xFF;
3553+ bits[0] = (context->count[1] >> 24) & 0xFF;
3554+
3555+ /* Pad out to 56 mod 64.
3556+ */
3557+ index = (unsigned int) ((context->count[0] >> 3) & 0x3f);
3558+ padLen = (index < 56) ? (56 - index) : (120 - index);
3559+ PHP_SHA256Update(context, PADDING, padLen);
3560+
3561+ /* Append length (before padding) */
3562+ PHP_SHA256Update(context, bits, 8);
3563+
3564+ /* Store state in digest */
3565+ SHA256Encode(digest, context->state, 32);
3566+
3567+ /* Zeroize sensitive information.
3568+ */
3569+ memset((unsigned char*) context, 0, sizeof(*context));
3570+}
3571+/* }}} */
3572+
3573+/* {{{ SHA256Transform
3574+ * SHA256 basic transformation. Transforms state based on block.
3575+ */
3576+static void SHA256Transform(state, block)
3577+php_uint32 state[8];
3578+const unsigned char block[64];
3579+{
3580+ php_uint32 a = state[0], b = state[1], c = state[2];
3581+ php_uint32 d = state[3], e = state[4], f = state[5];
3582+ php_uint32 g = state[6], h = state[7], x[16], tmp1, tmp2, t1;
3583+
3584+ SHA256Decode(x, block, 64);
3585+
3586+ ROUND(a, b, c, d, e, f, g, h, x[0], 0x428a2f98)
3587+ ROUND(h, a, b, c, d, e, f, g, x[1], 0x71374491)
3588+ ROUND(g, h, a, b, c, d, e, f, x[2], 0xb5c0fbcf)
3589+ ROUND(f, g, h, a, b, c, d, e, x[3], 0xe9b5dba5)
3590+ ROUND(e, f, g, h, a, b, c, d, x[4], 0x3956c25b)
3591+ ROUND(d, e, f, g, h, a, b, c, x[5], 0x59f111f1)
3592+ ROUND(c, d, e, f, g, h, a, b, x[6], 0x923f82a4)
3593+ ROUND(b, c, d, e, f, g, h, a, x[7], 0xab1c5ed5)
3594+ ROUND(a, b, c, d, e, f, g, h, x[8], 0xd807aa98)
3595+ ROUND(h, a, b, c, d, e, f, g, x[9], 0x12835b01)
3596+ ROUND(g, h, a, b, c, d, e, f, x[10], 0x243185be)
3597+ ROUND(f, g, h, a, b, c, d, e, x[11], 0x550c7dc3)
3598+ ROUND(e, f, g, h, a, b, c, d, x[12], 0x72be5d74)
3599+ ROUND(d, e, f, g, h, a, b, c, x[13], 0x80deb1fe)
3600+ ROUND(c, d, e, f, g, h, a, b, x[14], 0x9bdc06a7)
3601+ ROUND(b, c, d, e, f, g, h, a, x[15], 0xc19bf174)
3602+ ROUND(a, b, c, d, e, f, g, h, W(16), 0xe49b69c1)
3603+ ROUND(h, a, b, c, d, e, f, g, W(17), 0xefbe4786)
3604+ ROUND(g, h, a, b, c, d, e, f, W(18), 0x0fc19dc6)
3605+ ROUND(f, g, h, a, b, c, d, e, W(19), 0x240ca1cc)
3606+ ROUND(e, f, g, h, a, b, c, d, W(20), 0x2de92c6f)
3607+ ROUND(d, e, f, g, h, a, b, c, W(21), 0x4a7484aa)
3608+ ROUND(c, d, e, f, g, h, a, b, W(22), 0x5cb0a9dc)
3609+ ROUND(b, c, d, e, f, g, h, a, W(23), 0x76f988da)
3610+ ROUND(a, b, c, d, e, f, g, h, W(24), 0x983e5152)
3611+ ROUND(h, a, b, c, d, e, f, g, W(25), 0xa831c66d)
3612+ ROUND(g, h, a, b, c, d, e, f, W(26), 0xb00327c8)
3613+ ROUND(f, g, h, a, b, c, d, e, W(27), 0xbf597fc7)
3614+ ROUND(e, f, g, h, a, b, c, d, W(28), 0xc6e00bf3)
3615+ ROUND(d, e, f, g, h, a, b, c, W(29), 0xd5a79147)
3616+ ROUND(c, d, e, f, g, h, a, b, W(30), 0x06ca6351)
3617+ ROUND(b, c, d, e, f, g, h, a, W(31), 0x14292967)
3618+ ROUND(a, b, c, d, e, f, g, h, W(32), 0x27b70a85)
3619+ ROUND(h, a, b, c, d, e, f, g, W(33), 0x2e1b2138)
3620+ ROUND(g, h, a, b, c, d, e, f, W(34), 0x4d2c6dfc)
3621+ ROUND(f, g, h, a, b, c, d, e, W(35), 0x53380d13)
3622+ ROUND(e, f, g, h, a, b, c, d, W(36), 0x650a7354)
3623+ ROUND(d, e, f, g, h, a, b, c, W(37), 0x766a0abb)
3624+ ROUND(c, d, e, f, g, h, a, b, W(38), 0x81c2c92e)
3625+ ROUND(b, c, d, e, f, g, h, a, W(39), 0x92722c85)
3626+ ROUND(a, b, c, d, e, f, g, h, W(40), 0xa2bfe8a1)
3627+ ROUND(h, a, b, c, d, e, f, g, W(41), 0xa81a664b)
3628+ ROUND(g, h, a, b, c, d, e, f, W(42), 0xc24b8b70)
3629+ ROUND(f, g, h, a, b, c, d, e, W(43), 0xc76c51a3)
3630+ ROUND(e, f, g, h, a, b, c, d, W(44), 0xd192e819)
3631+ ROUND(d, e, f, g, h, a, b, c, W(45), 0xd6990624)
3632+ ROUND(c, d, e, f, g, h, a, b, W(46), 0xf40e3585)
3633+ ROUND(b, c, d, e, f, g, h, a, W(47), 0x106aa070)
3634+ ROUND(a, b, c, d, e, f, g, h, W(48), 0x19a4c116)
3635+ ROUND(h, a, b, c, d, e, f, g, W(49), 0x1e376c08)
3636+ ROUND(g, h, a, b, c, d, e, f, W(50), 0x2748774c)
3637+ ROUND(f, g, h, a, b, c, d, e, W(51), 0x34b0bcb5)
3638+ ROUND(e, f, g, h, a, b, c, d, W(52), 0x391c0cb3)
3639+ ROUND(d, e, f, g, h, a, b, c, W(53), 0x4ed8aa4a)
3640+ ROUND(c, d, e, f, g, h, a, b, W(54), 0x5b9cca4f)
3641+ ROUND(b, c, d, e, f, g, h, a, W(55), 0x682e6ff3)
3642+ ROUND(a, b, c, d, e, f, g, h, W(56), 0x748f82ee)
3643+ ROUND(h, a, b, c, d, e, f, g, W(57), 0x78a5636f)
3644+ ROUND(g, h, a, b, c, d, e, f, W(58), 0x84c87814)
3645+ ROUND(f, g, h, a, b, c, d, e, W(59), 0x8cc70208)
3646+ ROUND(e, f, g, h, a, b, c, d, W(60), 0x90befffa)
3647+ ROUND(d, e, f, g, h, a, b, c, W(61), 0xa4506ceb)
3648+ ROUND(c, d, e, f, g, h, a, b, W(62), 0xbef9a3f7)
3649+ ROUND(b, c, d, e, f, g, h, a, W(63), 0xc67178f2)
3650+
3651+ state[0] += a;
3652+ state[1] += b;
3653+ state[2] += c;
3654+ state[3] += d;
3655+ state[4] += e;
3656+ state[5] += f;
3657+ state[6] += g;
3658+ state[7] += h;
3659+
3660+ /* Zeroize sensitive information. */
3661+ memset((unsigned char*) x, 0, sizeof(x));
3662+}
3663+/* }}} */
3664+
3665+/* {{{ SHA256Encode
3666+ Encodes input (php_uint32) into output (unsigned char). Assumes len is
3667+ a multiple of 4.
3668+ */
3669+static void SHA256Encode(output, input, len)
3670+unsigned char *output;
3671+php_uint32 *input;
3672+unsigned int len;
3673+{
3674+ unsigned int i, j;
3675+
3676+ for (i = 0, j = 0; j < len; i++, j += 4) {
3677+ output[j] = (unsigned char) ((input[i] >> 24) & 0xff);
3678+ output[j + 1] = (unsigned char) ((input[i] >> 16) & 0xff);
3679+ output[j + 2] = (unsigned char) ((input[i] >> 8) & 0xff);
3680+ output[j + 3] = (unsigned char) (input[i] & 0xff);
3681+ }
3682+}
3683+/* }}} */
3684+
3685+/* {{{ SHA256Decode
3686+ Decodes input (unsigned char) into output (php_uint32). Assumes len is
3687+ a multiple of 4.
3688+ */
3689+static void SHA256Decode(output, input, len)
3690+php_uint32 *output;
3691+const unsigned char *input;
3692+unsigned int len;
3693+{
3694+ unsigned int i, j;
3695+
3696+ for (i = 0, j = 0; j < len; i++, j += 4)
3697+ output[i] = ((php_uint32) input[j + 3]) | (((php_uint32) input[j + 2]) << 8) |
3698+ (((php_uint32) input[j + 1]) << 16) | (((php_uint32) input[j]) << 24);
3699+}
3700+/* }}} */
3701+
3702+/*
3703+ * Local variables:
3704+ * tab-width: 4
3705+ * c-basic-offset: 4
3706+ * End:
3707+ * vim600: sw=4 ts=4 fdm=marker
3708+ * vim<600: sw=4 ts=4
3709+ */
3710diff -Nura php-4.4.2/ext/standard/sha256.h hardening-patch-4.4.2-0.4.15/ext/standard/sha256.h
3711--- php-4.4.2/ext/standard/sha256.h 1970-01-01 01:00:00.000000000 +0100
3712+++ hardening-patch-4.4.2-0.4.15/ext/standard/sha256.h 2006-09-05 20:30:33.000000000 +0200
3713@@ -0,0 +1,40 @@
3714+/*
3715+ +----------------------------------------------------------------------+
3716+ | PHP Version 5 |
3717+ +----------------------------------------------------------------------+
3718+ | Copyright (c) 1997-2004 The PHP Group |
3719+ +----------------------------------------------------------------------+
3720+ | This source file is subject to version 3.0 of the PHP license, |
3721+ | that is bundled with this package in the file LICENSE, and is |
3722+ | available through the world-wide-web at the following url: |
3723+ | http://www.php.net/license/3_0.txt. |
3724+ | If you did not receive a copy of the PHP license and are unable to |
3725+ | obtain it through the world-wide-web, please send a note to |
3726+ | license@php.net so we can mail you a copy immediately. |
3727+ +----------------------------------------------------------------------+
3728+ | Author: Stefan Esser <sesser@php.net> |
3729+ +----------------------------------------------------------------------+
3730+*/
3731+
3732+/* $Id: sha256.h,v 1.4 2004/01/08 17:32:52 sniper Exp $ */
3733+
3734+#ifndef SHA256_H
3735+#define SHA256_H
3736+
3737+#include "ext/standard/basic_functions.h"
3738+
3739+/* SHA1 context. */
3740+typedef struct {
3741+ php_uint32 state[8]; /* state (ABCD) */
3742+ php_uint32 count[2]; /* number of bits, modulo 2^64 (lsb first) */
3743+ unsigned char buffer[64]; /* input buffer */
3744+} PHP_SHA256_CTX;
3745+
3746+PHPAPI void PHP_SHA256Init(PHP_SHA256_CTX *);
3747+PHPAPI void PHP_SHA256Update(PHP_SHA256_CTX *, const unsigned char *, unsigned int);
3748+PHPAPI void PHP_SHA256Final(unsigned char[32], PHP_SHA256_CTX *);
3749+
3750+PHP_FUNCTION(sha256);
3751+PHP_FUNCTION(sha256_file);
3752+
3753+#endif
3754diff -Nura php-4.4.2/ext/standard/string.c hardening-patch-4.4.2-0.4.15/ext/standard/string.c
3755--- php-4.4.2/ext/standard/string.c 2006-01-01 14:46:58.000000000 +0100
3756+++ hardening-patch-4.4.2-0.4.15/ext/standard/string.c 2006-09-05 20:30:33.000000000 +0200
3757@@ -18,7 +18,7 @@
3758 +----------------------------------------------------------------------+
3759 */
3760
3761-/* $Id: string.c,v 1.333.2.52.2.3 2006/01/01 13:46:58 sniper Exp $ */
3762+/* $Id: string.c,v 1.333.2.52.2.4 2006/03/13 14:41:27 iliaa Exp $ */
3763
3764 /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
3765
3766@@ -628,7 +628,8 @@
3767 {
3768 const char *text, *breakchar = "\n";
3769 char *newtext;
3770- int textlen, breakcharlen = 1, newtextlen, alloced, chk;
3771+ int textlen, breakcharlen = 1, newtextlen, chk;
3772+ size_t alloced;
3773 long current = 0, laststart = 0, lastspace = 0;
3774 long linelength = 75;
3775 zend_bool docut = 0;
3776@@ -672,15 +673,13 @@
3777 /* Multiple character line break or forced cut */
3778 if (linelength > 0) {
3779 chk = (int)(textlen/linelength + 1);
3780+ newtext = safe_emalloc(chk, breakcharlen, textlen + 1);
3781 alloced = textlen + chk * breakcharlen + 1;
3782 } else {
3783 chk = textlen;
3784+ newtext = safe_emalloc(textlen, (breakcharlen + 1), 1);
3785 alloced = textlen * (breakcharlen + 1) + 1;
3786 }
3787- if (alloced <= 0) {
3788- RETURN_FALSE;
3789- }
3790- newtext = emalloc(alloced);
3791
3792 /* now keep track of the actual new text length */
3793 newtextlen = 0;
3794@@ -3515,7 +3514,7 @@
3795 zval **input_str; /* Input string */
3796 zval **mult; /* Multiplier */
3797 char *result; /* Resulting string */
3798- int result_len; /* Length of the resulting string */
3799+ size_t result_len; /* Length of the resulting string */
3800
3801 if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &input_str, &mult) == FAILURE) {
3802 WRONG_PARAM_COUNT;
3803@@ -3540,11 +3539,7 @@
3804
3805 /* Initialize the result string */
3806 result_len = Z_STRLEN_PP(input_str) * Z_LVAL_PP(mult);
3807- if (result_len < 1) {
3808- php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may not create strings longer than 2147483647 bytes");
3809- RETURN_FALSE;
3810- }
3811- result = (char *)emalloc(result_len + 1);
3812+ result = (char *)safe_emalloc(Z_STRLEN_PP(input_str), Z_LVAL_PP(mult), 1);
3813
3814 /* Heavy optimization for situations where input string is 1 byte long */
3815 if (Z_STRLEN_PP(input_str) == 1) {
3816diff -Nura php-4.4.2/ext/standard/syslog.c hardening-patch-4.4.2-0.4.15/ext/standard/syslog.c
3817--- php-4.4.2/ext/standard/syslog.c 2006-01-01 14:46:58.000000000 +0100
3818+++ hardening-patch-4.4.2-0.4.15/ext/standard/syslog.c 2006-09-05 20:30:33.000000000 +0200
3819@@ -42,6 +42,8 @@
3820 */
3821 PHP_MINIT_FUNCTION(syslog)
3822 {
3823+
3824+#if !HARDENING_PATCH
3825 /* error levels */
3826 REGISTER_LONG_CONSTANT("LOG_EMERG", LOG_EMERG, CONST_CS | CONST_PERSISTENT); /* system unusable */
3827 REGISTER_LONG_CONSTANT("LOG_ALERT", LOG_ALERT, CONST_CS | CONST_PERSISTENT); /* immediate action required */
3828@@ -97,7 +99,7 @@
3829 /* AIX doesn't have LOG_PERROR */
3830 REGISTER_LONG_CONSTANT("LOG_PERROR", LOG_PERROR, CONST_CS | CONST_PERSISTENT); /*log to stderr*/
3831 #endif
3832-
3833+#endif
3834 return SUCCESS;
3835 }
3836 /* }}} */
3837diff -Nura php-4.4.2/ext/standard/tests/strings/bug38322.phpt hardening-patch-4.4.2-0.4.15/ext/standard/tests/strings/bug38322.phpt
3838--- php-4.4.2/ext/standard/tests/strings/bug38322.phpt 1970-01-01 01:00:00.000000000 +0100
3839+++ hardening-patch-4.4.2-0.4.15/ext/standard/tests/strings/bug38322.phpt 2006-09-05 20:30:33.000000000 +0200
3840@@ -0,0 +1,13 @@
3841+--TEST--
3842+Bug #38322 (reading past array in sscanf() leads to segfault/arbitary code execution)
3843+--FILE--
3844+<?php
3845+
3846+$str = "a b c d e";
3847+var_dump(sscanf("a ",'%1$s',$str));
3848+
3849+echo "Done\n";
3850+?>
3851+--EXPECTF--
3852+int(1)
3853+Done
3854diff -Nura php-4.4.2/ext/standard/url.c hardening-patch-4.4.2-0.4.15/ext/standard/url.c
3855--- php-4.4.2/ext/standard/url.c 2006-01-01 14:46:58.000000000 +0100
3856+++ hardening-patch-4.4.2-0.4.15/ext/standard/url.c 2006-09-05 20:30:33.000000000 +0200
3857@@ -15,7 +15,7 @@
3858 | Author: Jim Winstead <jimw@php.net> |
3859 +----------------------------------------------------------------------+
3860 */
3861-/* $Id: url.c,v 1.58.2.21.2.2 2006/01/01 13:46:58 sniper Exp $ */
3862+/* $Id: url.c,v 1.58.2.21.2.3 2006/02/12 16:43:03 iliaa Exp $ */
3863
3864 #include <stdlib.h>
3865 #include <string.h>
3866@@ -137,7 +137,7 @@
3867 p++;
3868 }
3869
3870- if ((*p) == '\0' || *p == '/') {
3871+ if ((*p == '\0' || *p == '/') && (p - e) < 7) {
3872 goto parse_port;
3873 }
3874
3875diff -Nura php-4.4.2/ext/varfilter/config.m4 hardening-patch-4.4.2-0.4.15/ext/varfilter/config.m4
3876--- php-4.4.2/ext/varfilter/config.m4 1970-01-01 01:00:00.000000000 +0100
3877+++ hardening-patch-4.4.2-0.4.15/ext/varfilter/config.m4 2006-09-05 20:30:33.000000000 +0200
3878@@ -0,0 +1,11 @@
3879+dnl
3880+dnl $Id: config.m4,v 1.1 2004/11/14 13:27:16 ionic Exp $
3881+dnl
3882+
3883+PHP_ARG_ENABLE(varfilter, whether to enable Hardening-Patch's variable filter,
3884+[ --disable-varfilter Disable Hardening-Patch's variable filter], yes)
3885+
3886+if test "$PHP_VARFILTER" != "no"; then
3887+ AC_DEFINE(HAVE_VARFILTER, 1, [ ])
3888+ PHP_NEW_EXTENSION(varfilter, varfilter.c, $ext_shared)
3889+fi
3890diff -Nura php-4.4.2/ext/varfilter/CREDITS hardening-patch-4.4.2-0.4.15/ext/varfilter/CREDITS
3891--- php-4.4.2/ext/varfilter/CREDITS 1970-01-01 01:00:00.000000000 +0100
3892+++ hardening-patch-4.4.2-0.4.15/ext/varfilter/CREDITS 2006-09-05 20:30:33.000000000 +0200
3893@@ -0,0 +1,2 @@
3894+varfilter
3895+Stefan Esser
3896\ Kein Zeilenumbruch am Dateiende.
3897diff -Nura php-4.4.2/ext/varfilter/php_varfilter.h hardening-patch-4.4.2-0.4.15/ext/varfilter/php_varfilter.h
3898--- php-4.4.2/ext/varfilter/php_varfilter.h 1970-01-01 01:00:00.000000000 +0100
3899+++ hardening-patch-4.4.2-0.4.15/ext/varfilter/php_varfilter.h 2006-09-05 20:30:33.000000000 +0200
3900@@ -0,0 +1,144 @@
3901+/*
3902+ +----------------------------------------------------------------------+
3903+ | Hardened-PHP Project's varfilter extension |
3904+ +----------------------------------------------------------------------+
3905+ | Copyright (c) 2004-2005 Stefan Esser |
3906+ +----------------------------------------------------------------------+
3907+ | This source file is subject to version 2.02 of the PHP license, |
3908+ | that is bundled with this package in the file LICENSE, and is |
3909+ | available at through the world-wide-web at |
3910+ | http://www.php.net/license/2_02.txt. |
3911+ | If you did not receive a copy of the PHP license and are unable to |
3912+ | obtain it through the world-wide-web, please send a note to |
3913+ | license@php.net so we can mail you a copy immediately. |
3914+ +----------------------------------------------------------------------+
3915+ | Author: Stefan Esser <sesser@hardened-php.net> |
3916+ +----------------------------------------------------------------------+
3917+
3918+ $Id: php_varfilter.h,v 1.1 2004/11/14 13:27:16 ionic Exp $
3919+*/
3920+
3921+#ifndef PHP_VARFILTER_H
3922+#define PHP_VARFILTER_H
3923+
3924+extern zend_module_entry varfilter_module_entry;
3925+#define phpext_varfilter_ptr &varfilter_module_entry
3926+
3927+#ifdef PHP_WIN32
3928+#define PHP_VARFILTER_API __declspec(dllexport)
3929+#else
3930+#define PHP_VARFILTER_API
3931+#endif
3932+
3933+#ifdef ZTS
3934+#include "TSRM.h"
3935+#endif
3936+
3937+#include "SAPI.h"
3938+
3939+#include "php_variables.h"
3940+
3941+#ifdef ZEND_ENGINE_2
3942+#define HASH_HTTP_GET_VARS 0x2095733f
3943+#define HASH_HTTP_POST_VARS 0xbfee1265
3944+#define HASH_HTTP_COOKIE_VARS 0xaaca9d99
3945+#define HASH_HTTP_ENV_VARS 0x1fe186a8
3946+#define HASH_HTTP_SERVER_VARS 0xc987afd6
3947+#define HASH_HTTP_SESSION_VARS 0x7aba0d43
3948+#define HASH_HTTP_POST_FILES 0x98eb1ddc
3949+#define HASH_HTTP_RAW_POST_DATA 0xdd633fec
3950+#else
3951+#define HASH_HTTP_GET_VARS 0x8d8645bd
3952+#define HASH_HTTP_POST_VARS 0x7c699bf3
3953+#define HASH_HTTP_COOKIE_VARS 0x93ad0d6f
3954+#define HASH_HTTP_ENV_VARS 0x84da3016
3955+#define HASH_HTTP_SERVER_VARS 0x6dbf964e
3956+#define HASH_HTTP_SESSION_VARS 0x322906f5
3957+#define HASH_HTTP_POST_FILES 0xe4e4ce70
3958+#define HASH_HTTP_RAW_POST_DATA 0xe6137a0e
3959+#endif
3960+
3961+PHP_MINIT_FUNCTION(varfilter);
3962+PHP_MSHUTDOWN_FUNCTION(varfilter);
3963+PHP_RINIT_FUNCTION(varfilter);
3964+PHP_RSHUTDOWN_FUNCTION(varfilter);
3965+PHP_MINFO_FUNCTION(varfilter);
3966+
3967+
3968+ZEND_BEGIN_MODULE_GLOBALS(varfilter)
3969+/* request variables */
3970+ long max_request_variables;
3971+ long cur_request_variables;
3972+ long max_varname_length;
3973+ long max_totalname_length;
3974+ long max_value_length;
3975+ long max_array_depth;
3976+ long max_array_index_length;
3977+ zend_bool disallow_nul;
3978+/* cookie variables */
3979+ long max_cookie_vars;
3980+ long cur_cookie_vars;
3981+ long max_cookie_name_length;
3982+ long max_cookie_totalname_length;
3983+ long max_cookie_value_length;
3984+ long max_cookie_array_depth;
3985+ long max_cookie_array_index_length;
3986+ zend_bool disallow_cookie_nul;
3987+/* get variables */
3988+ long max_get_vars;
3989+ long cur_get_vars;
3990+ long max_get_name_length;
3991+ long max_get_totalname_length;
3992+ long max_get_value_length;
3993+ long max_get_array_depth;
3994+ long max_get_array_index_length;
3995+ zend_bool disallow_get_nul;
3996+/* post variables */
3997+ long max_post_vars;
3998+ long cur_post_vars;
3999+ long max_post_name_length;
4000+ long max_post_totalname_length;
4001+ long max_post_value_length;
4002+ long max_post_array_depth;
4003+ long max_post_array_index_length;
4004+ zend_bool disallow_post_nul;
4005+/* fileupload */
4006+ long max_uploads;
4007+ long cur_uploads;
4008+ zend_bool disallow_elf_files;
4009+ char *verification_script;
4010+
4011+ zend_bool no_more_variables;
4012+ zend_bool no_more_get_variables;
4013+ zend_bool no_more_post_variables;
4014+ zend_bool no_more_cookie_variables;
4015+ zend_bool no_more_uploads;
4016+
4017+ZEND_END_MODULE_GLOBALS(varfilter)
4018+
4019+
4020+#ifdef ZTS
4021+#define VARFILTER_G(v) TSRMG(varfilter_globals_id, zend_varfilter_globals *, v)
4022+#else
4023+#define VARFILTER_G(v) (varfilter_globals.v)
4024+#endif
4025+
4026+SAPI_INPUT_FILTER_FUNC(varfilter_input_filter);
4027+SAPI_UPLOAD_VARNAME_FILTER_FUNC(varfilter_upload_varname_filter);
4028+SAPI_PRE_UPLOAD_FILTER_FUNC(varfilter_pre_upload_filter);
4029+SAPI_UPLOAD_CONTENT_FILTER_FUNC(varfilter_upload_content_filter);
4030+SAPI_POST_UPLOAD_FILTER_FUNC(varfilter_post_upload_filter);
4031+SAPI_TREAT_DATA_FUNC(varfilter_treat_data);
4032+
4033+
4034+
4035+#endif /* PHP_VARFILTER_H */
4036+
4037+
4038+/*
4039+ * Local variables:
4040+ * tab-width: 4
4041+ * c-basic-offset: 4
4042+ * indent-tabs-mode: t
4043+ * End:
4044+ */
4045diff -Nura php-4.4.2/ext/varfilter/varfilter.c hardening-patch-4.4.2-0.4.15/ext/varfilter/varfilter.c
4046--- php-4.4.2/ext/varfilter/varfilter.c 1970-01-01 01:00:00.000000000 +0100
4047+++ hardening-patch-4.4.2-0.4.15/ext/varfilter/varfilter.c 2006-09-07 18:48:50.000000000 +0200
4048@@ -0,0 +1,915 @@
4049+/*
4050+ +----------------------------------------------------------------------+
4051+ | Hardened-PHP Project's varfilter extension |
4052+ +----------------------------------------------------------------------+
4053+ | Copyright (c) 2004-2005 Stefan Esser |
4054+ +----------------------------------------------------------------------+
4055+ | This source file is subject to version 2.02 of the PHP license, |
4056+ | that is bundled with this package in the file LICENSE, and is |
4057+ | available at through the world-wide-web at |
4058+ | http://www.php.net/license/2_02.txt. |
4059+ | If you did not receive a copy of the PHP license and are unable to |
4060+ | obtain it through the world-wide-web, please send a note to |
4061+ | license@php.net so we can mail you a copy immediately. |
4062+ +----------------------------------------------------------------------+
4063+ | Author: Stefan Esser <sesser@hardened-php.net> |
4064+ +----------------------------------------------------------------------+
4065+
4066+ $Id: varfilter.c,v 1.1 2004/11/14 13:27:16 ionic Exp $
4067+*/
4068+
4069+#ifdef HAVE_CONFIG_H
4070+#include "config.h"
4071+#endif
4072+
4073+#include "php.h"
4074+#include "php_ini.h"
4075+#include "ext/standard/info.h"
4076+#include "php_varfilter.h"
4077+#include "hardening_patch.h"
4078+
4079+ZEND_DECLARE_MODULE_GLOBALS(varfilter)
4080+
4081+/* True global resources - no need for thread safety here */
4082+static int le_varfilter;
4083+
4084+static void (*orig_register_server_variables)(zval *track_vars_array TSRMLS_DC) = NULL;
4085+static int (*orig_header_handler)(sapi_header_struct *sapi_header, sapi_headers_struct *sapi_headers TSRMLS_DC) = NULL;
4086+static zend_bool hooked = 0;
4087+
4088+/* {{{ varfilter_module_entry
4089+ */
4090+zend_module_entry varfilter_module_entry = {
4091+#if ZEND_MODULE_API_NO >= 20010901
4092+ STANDARD_MODULE_HEADER,
4093+#endif
4094+ "varfilter",
4095+ NULL,
4096+ PHP_MINIT(varfilter),
4097+ PHP_MSHUTDOWN(varfilter),
4098+ PHP_RINIT(varfilter), /* Replace with NULL if there's nothing to do at request start */
4099+ PHP_RSHUTDOWN(varfilter), /* Replace with NULL if there's nothing to do at request end */
4100+ PHP_MINFO(varfilter),
4101+#if ZEND_MODULE_API_NO >= 20010901
4102+ "0.4.15", /* Replace with version number for your extension */
4103+#endif
4104+ STANDARD_MODULE_PROPERTIES
4105+};
4106+/* }}} */
4107+
4108+#ifdef COMPILE_DL_VARFILTER
4109+ZEND_GET_MODULE(varfilter)
4110+#endif
4111+
4112+/* {{{ PHP_INI
4113+ */
4114+PHP_INI_BEGIN()
4115+ /* for backward compatibility */
4116+ STD_PHP_INI_ENTRY("varfilter.max_request_variables", "200", PHP_INI_PERDIR, OnUpdateLong, max_request_variables, zend_varfilter_globals, varfilter_globals)
4117+ STD_PHP_INI_ENTRY("varfilter.max_varname_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_varname_length, zend_varfilter_globals, varfilter_globals)
4118+ STD_PHP_INI_ENTRY("varfilter.max_value_length", "65000", PHP_INI_PERDIR, OnUpdateLong, max_value_length, zend_varfilter_globals, varfilter_globals)
4119+ STD_PHP_INI_ENTRY("varfilter.max_array_depth", "100", PHP_INI_PERDIR, OnUpdateLong, max_array_depth, zend_varfilter_globals, varfilter_globals)
4120+ STD_PHP_INI_ENTRY("varfilter.max_totalname_length", "256", PHP_INI_PERDIR, OnUpdateLong, max_totalname_length, zend_varfilter_globals, varfilter_globals)
4121+ STD_PHP_INI_ENTRY("varfilter.max_array_index_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_array_index_length, zend_varfilter_globals, varfilter_globals)
4122+
4123+ STD_PHP_INI_ENTRY("hphp.request.max_vars", "200", PHP_INI_PERDIR, OnUpdateLong, max_request_variables, zend_varfilter_globals, varfilter_globals)
4124+ STD_PHP_INI_ENTRY("hphp.request.max_varname_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_varname_length, zend_varfilter_globals, varfilter_globals)
4125+ STD_PHP_INI_ENTRY("hphp.request.max_value_length", "65000", PHP_INI_PERDIR, OnUpdateLong, max_value_length, zend_varfilter_globals, varfilter_globals)
4126+ STD_PHP_INI_ENTRY("hphp.request.max_array_depth", "100", PHP_INI_PERDIR, OnUpdateLong, max_array_depth, zend_varfilter_globals, varfilter_globals)
4127+ STD_PHP_INI_ENTRY("hphp.request.max_totalname_length", "256", PHP_INI_PERDIR, OnUpdateLong, max_totalname_length, zend_varfilter_globals, varfilter_globals)
4128+ STD_PHP_INI_ENTRY("hphp.request.max_array_index_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_array_index_length, zend_varfilter_globals, varfilter_globals)
4129+ STD_PHP_INI_ENTRY("hphp.request.disallow_nul", "1", PHP_INI_PERDIR, OnUpdateBool, disallow_nul, zend_varfilter_globals, varfilter_globals)
4130+
4131+ STD_PHP_INI_ENTRY("hphp.cookie.max_vars", "100", PHP_INI_PERDIR, OnUpdateLong, max_cookie_vars, zend_varfilter_globals, varfilter_globals)
4132+ STD_PHP_INI_ENTRY("hphp.cookie.max_name_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_cookie_name_length, zend_varfilter_globals, varfilter_globals)
4133+ STD_PHP_INI_ENTRY("hphp.cookie.max_totalname_length", "256", PHP_INI_PERDIR, OnUpdateLong, max_cookie_totalname_length, zend_varfilter_globals, varfilter_globals)
4134+ STD_PHP_INI_ENTRY("hphp.cookie.max_value_length", "10000", PHP_INI_PERDIR, OnUpdateLong, max_cookie_value_length, zend_varfilter_globals, varfilter_globals)
4135+ STD_PHP_INI_ENTRY("hphp.cookie.max_array_depth", "100", PHP_INI_PERDIR, OnUpdateLong, max_cookie_array_depth, zend_varfilter_globals, varfilter_globals)
4136+ STD_PHP_INI_ENTRY("hphp.cookie.max_array_index_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_cookie_array_index_length, zend_varfilter_globals, varfilter_globals)
4137+ STD_PHP_INI_ENTRY("hphp.cookie.disallow_nul", "1", PHP_INI_PERDIR, OnUpdateBool, disallow_cookie_nul, zend_varfilter_globals, varfilter_globals)
4138+
4139+ STD_PHP_INI_ENTRY("hphp.get.max_vars", "100", PHP_INI_PERDIR, OnUpdateLong, max_get_vars, zend_varfilter_globals, varfilter_globals)
4140+ STD_PHP_INI_ENTRY("hphp.get.max_name_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_get_name_length, zend_varfilter_globals, varfilter_globals)
4141+ STD_PHP_INI_ENTRY("hphp.get.max_totalname_length", "256", PHP_INI_PERDIR, OnUpdateLong, max_get_totalname_length, zend_varfilter_globals, varfilter_globals)
4142+ STD_PHP_INI_ENTRY("hphp.get.max_value_length", "512", PHP_INI_PERDIR, OnUpdateLong, max_get_value_length, zend_varfilter_globals, varfilter_globals)
4143+ STD_PHP_INI_ENTRY("hphp.get.max_array_depth", "50", PHP_INI_PERDIR, OnUpdateLong, max_get_array_depth, zend_varfilter_globals, varfilter_globals)
4144+ STD_PHP_INI_ENTRY("hphp.get.max_array_index_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_get_array_index_length, zend_varfilter_globals, varfilter_globals)
4145+ STD_PHP_INI_ENTRY("hphp.get.disallow_nul", "1", PHP_INI_PERDIR, OnUpdateBool, disallow_get_nul, zend_varfilter_globals, varfilter_globals)
4146+
4147+ STD_PHP_INI_ENTRY("hphp.post.max_vars", "200", PHP_INI_PERDIR, OnUpdateLong, max_post_vars, zend_varfilter_globals, varfilter_globals)
4148+ STD_PHP_INI_ENTRY("hphp.post.max_name_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_post_name_length, zend_varfilter_globals, varfilter_globals)
4149+ STD_PHP_INI_ENTRY("hphp.post.max_totalname_length", "256", PHP_INI_PERDIR, OnUpdateLong, max_post_totalname_length, zend_varfilter_globals, varfilter_globals)
4150+ STD_PHP_INI_ENTRY("hphp.post.max_value_length", "65000", PHP_INI_PERDIR, OnUpdateLong, max_post_value_length, zend_varfilter_globals, varfilter_globals)
4151+ STD_PHP_INI_ENTRY("hphp.post.max_array_depth", "100", PHP_INI_PERDIR, OnUpdateLong, max_post_array_depth, zend_varfilter_globals, varfilter_globals)
4152+ STD_PHP_INI_ENTRY("hphp.post.max_array_index_length", "64", PHP_INI_PERDIR, OnUpdateLong, max_post_array_index_length, zend_varfilter_globals, varfilter_globals)
4153+ STD_PHP_INI_ENTRY("hphp.post.disallow_nul", "1", PHP_INI_PERDIR, OnUpdateBool, disallow_post_nul, zend_varfilter_globals, varfilter_globals)
4154+
4155+ STD_PHP_INI_ENTRY("hphp.upload.max_uploads", "25", PHP_INI_PERDIR, OnUpdateLong, max_uploads, zend_varfilter_globals, varfilter_globals)
4156+ STD_PHP_INI_ENTRY("hphp.upload.disallow_elf_files", "1", PHP_INI_SYSTEM, OnUpdateBool, disallow_elf_files, zend_varfilter_globals, varfilter_globals)
4157+ STD_PHP_INI_ENTRY("hphp.upload.verification_script", NULL, PHP_INI_SYSTEM, OnUpdateString, verification_script, zend_varfilter_globals, varfilter_globals)
4158+
4159+
4160+PHP_INI_END()
4161+/* }}} */
4162+
4163+/* {{{ php_varfilter_init_globals
4164+ */
4165+static void php_varfilter_init_globals(zend_varfilter_globals *varfilter_globals)
4166+{
4167+ varfilter_globals->max_request_variables = 200;
4168+ varfilter_globals->max_varname_length = 64;
4169+ varfilter_globals->max_value_length = 10000;
4170+ varfilter_globals->max_array_depth = 100;
4171+ varfilter_globals->max_totalname_length = 256;
4172+ varfilter_globals->max_array_index_length = 64;
4173+ varfilter_globals->disallow_nul = 1;
4174+
4175+ varfilter_globals->max_cookie_vars = 100;
4176+ varfilter_globals->max_cookie_name_length = 64;
4177+ varfilter_globals->max_cookie_totalname_length = 256;
4178+ varfilter_globals->max_cookie_value_length = 10000;
4179+ varfilter_globals->max_cookie_array_depth = 100;
4180+ varfilter_globals->max_cookie_array_index_length = 64;
4181+ varfilter_globals->disallow_cookie_nul = 1;
4182+
4183+ varfilter_globals->max_get_vars = 100;
4184+ varfilter_globals->max_get_name_length = 64;
4185+ varfilter_globals->max_get_totalname_length = 256;
4186+ varfilter_globals->max_get_value_length = 512;
4187+ varfilter_globals->max_get_array_depth = 50;
4188+ varfilter_globals->max_get_array_index_length = 64;
4189+ varfilter_globals->disallow_get_nul = 1;
4190+
4191+ varfilter_globals->max_post_vars = 200;
4192+ varfilter_globals->max_post_name_length = 64;
4193+ varfilter_globals->max_post_totalname_length = 256;
4194+ varfilter_globals->max_post_value_length = 65000;
4195+ varfilter_globals->max_post_array_depth = 100;
4196+ varfilter_globals->max_post_array_index_length = 64;
4197+ varfilter_globals->disallow_post_nul = 1;
4198+
4199+ varfilter_globals->max_uploads = 25;
4200+ varfilter_globals->disallow_elf_files = 1;
4201+ varfilter_globals->verification_script = NULL;
4202+
4203+ varfilter_globals->no_more_variables = 0;
4204+ varfilter_globals->no_more_get_variables = 0;
4205+ varfilter_globals->no_more_post_variables = 0;
4206+ varfilter_globals->no_more_cookie_variables = 0;
4207+ varfilter_globals->no_more_uploads = 0;
4208+
4209+ varfilter_globals->cur_request_variables = 0;
4210+ varfilter_globals->cur_get_vars = 0;
4211+ varfilter_globals->cur_post_vars = 0;
4212+ varfilter_globals->cur_cookie_vars = 0;
4213+
4214+ varfilter_globals->cur_uploads = 0;
4215+
4216+}
4217+/* }}} */
4218+
4219+
4220+void varfilter_register_server_variables(zval *track_vars_array TSRMLS_DC)
4221+{
4222+ HashTable *svars;
4223+ int retval, failure=0;
4224+
4225+ orig_register_server_variables(track_vars_array TSRMLS_CC);
4226+
4227+ svars = Z_ARRVAL_P(track_vars_array);
4228+
4229+ retval = zend_hash_del_key_or_index(svars, "HTTP_GET_VARS", sizeof("HTTP_GET_VARS"), HASH_HTTP_GET_VARS, HASH_DEL_INDEX);
4230+ if (retval == SUCCESS) failure = 1;
4231+ retval = zend_hash_del_key_or_index(svars, "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"), HASH_HTTP_POST_VARS, HASH_DEL_INDEX);
4232+ if (retval == SUCCESS) failure = 1;
4233+ retval = zend_hash_del_key_or_index(svars, "HTTP_COOKIE_VARS", sizeof("HTTP_COOKIE_VARS"), HASH_HTTP_COOKIE_VARS, HASH_DEL_INDEX);
4234+ if (retval == SUCCESS) failure = 1;
4235+ retval = zend_hash_del_key_or_index(svars, "HTTP_ENV_VARS", sizeof("HTTP_ENV_VARS"), HASH_HTTP_ENV_VARS, HASH_DEL_INDEX);
4236+ if (retval == SUCCESS) failure = 1;
4237+ retval = zend_hash_del_key_or_index(svars, "HTTP_SERVER_VARS", sizeof("HTTP_SERVER_VARS"), HASH_HTTP_SERVER_VARS, HASH_DEL_INDEX);
4238+ if (retval == SUCCESS) failure = 1;
4239+ retval = zend_hash_del_key_or_index(svars, "HTTP_SESSION_VARS", sizeof("HTTP_SESSION_VARS"), HASH_HTTP_SESSION_VARS, HASH_DEL_INDEX);
4240+ if (retval == SUCCESS) failure = 1;
4241+ retval = zend_hash_del_key_or_index(svars, "HTTP_POST_FILES", sizeof("HTTP_POST_FILES"), HASH_HTTP_POST_FILES, HASH_DEL_INDEX);
4242+ if (retval == SUCCESS) failure = 1;
4243+ retval = zend_hash_del_key_or_index(svars, "HTTP_RAW_POST_DATA", sizeof("HTTP_RAW_POST_DATA"), HASH_HTTP_RAW_POST_DATA, HASH_DEL_INDEX);
4244+ if (retval == SUCCESS) failure = 1;
4245+
4246+ if (failure) {
4247+ php_security_log(S_VARS, "Attacker tried to overwrite a superglobal through a HTTP header");
4248+ }
4249+}
4250+
4251+int varfilter_header_handler(sapi_header_struct *sapi_header, sapi_headers_struct *sapi_headers TSRMLS_DC)
4252+{
4253+ int retval = SAPI_HEADER_ADD, i;
4254+ char *tmp;
4255+
4256+ if (!HG(hphp_multiheader) && sapi_header && sapi_header->header) {
4257+
4258+ tmp = sapi_header->header;
4259+ for (i=0; i<sapi_header->header_len; i++, tmp++) {
4260+ if (tmp[0] == 0) {
4261+ char *fname = get_active_function_name(TSRMLS_C);
4262+
4263+ if (!fname) {
4264+ fname = "unknown";
4265+ }
4266+
4267+ php_security_log(S_MISC, "%s() - wanted to send a HTTP header with an ASCII NUL in it", fname);
4268+ sapi_header->header_len = i;
4269+ } else if (tmp[0] == '\n' && (i == sapi_header->header_len-1 || (tmp[1] != ' ' && tmp[1] != '\t'))) {
4270+ char *fname = get_active_function_name(TSRMLS_C);
4271+
4272+ if (!fname) {
4273+ fname = "unknown";
4274+ }
4275+
4276+ php_security_log(S_MISC, "%s() - wanted to send multiple HTTP headers at once", fname);
4277+ sapi_header->header_len = i;
4278+ tmp[0] = 0;
4279+ }
4280+ }
4281+ }
4282+
4283+ if (orig_header_handler) {
4284+ retval = orig_header_handler(sapi_header, sapi_headers TSRMLS_CC);
4285+ }
4286+
4287+ return retval;
4288+}
4289+
4290+/* {{{ PHP_MINIT_FUNCTION
4291+ */
4292+PHP_MINIT_FUNCTION(varfilter)
4293+{
4294+ ZEND_INIT_MODULE_GLOBALS(varfilter, php_varfilter_init_globals, NULL);
4295+ REGISTER_INI_ENTRIES();
4296+
4297+ if (!hooked) {
4298+ void *temp;
4299+ hooked = 1;
4300+
4301+ temp = (void *)sapi_module.register_server_variables;
4302+ if (temp != varfilter_register_server_variables) {
4303+ orig_register_server_variables = temp;
4304+ }
4305+ temp = (void *)sapi_module.header_handler;
4306+ if (temp != varfilter_header_handler) {
4307+ orig_header_handler = temp;
4308+ }
4309+ }
4310+
4311+ sapi_register_input_filter(varfilter_input_filter);
4312+ sapi_register_upload_varname_filter(varfilter_upload_varname_filter);
4313+ sapi_register_pre_upload_filter(varfilter_pre_upload_filter);
4314+ sapi_register_upload_content_filter(varfilter_upload_content_filter);
4315+ sapi_register_post_upload_filter(varfilter_post_upload_filter);
4316+
4317+ sapi_module.header_handler = varfilter_header_handler;
4318+ sapi_module.register_server_variables = varfilter_register_server_variables;
4319+
4320+
4321+ return SUCCESS;
4322+}
4323+/* }}} */
4324+
4325+/* {{{ PHP_MSHUTDOWN_FUNCTION
4326+ */
4327+PHP_MSHUTDOWN_FUNCTION(varfilter)
4328+{
4329+ UNREGISTER_INI_ENTRIES();
4330+
4331+ return SUCCESS;
4332+}
4333+/* }}} */
4334+
4335+/* Remove if there's nothing to do at request start */
4336+/* {{{ PHP_RINIT_FUNCTION
4337+ */
4338+PHP_RINIT_FUNCTION(varfilter)
4339+{
4340+ VARFILTER_G(cur_request_variables) = 0;
4341+ VARFILTER_G(cur_get_vars) = 0;
4342+ VARFILTER_G(cur_post_vars) = 0;
4343+ VARFILTER_G(cur_cookie_vars) = 0;
4344+
4345+ VARFILTER_G(cur_uploads) = 0;
4346+
4347+ VARFILTER_G(no_more_variables) = 0;
4348+ VARFILTER_G(no_more_get_variables) = 0;
4349+ VARFILTER_G(no_more_post_variables) = 0;
4350+ VARFILTER_G(no_more_cookie_variables) = 0;
4351+ VARFILTER_G(no_more_uploads) = 0;
4352+
4353+ return SUCCESS;
4354+}
4355+/* }}} */
4356+
4357+/* Remove if there's nothing to do at request end */
4358+/* {{{ PHP_RSHUTDOWN_FUNCTION
4359+ */
4360+PHP_RSHUTDOWN_FUNCTION(varfilter)
4361+{
4362+ return SUCCESS;
4363+}
4364+/* }}} */
4365+
4366+/* {{{ PHP_MINFO_FUNCTION
4367+ */
4368+PHP_MINFO_FUNCTION(varfilter)
4369+{
4370+ php_info_print_table_start();
4371+ php_info_print_table_header(2, "Hardening-Patch's variable filter support", "enabled");
4372+ php_info_print_table_end();
4373+
4374+ DISPLAY_INI_ENTRIES();
4375+}
4376+/* }}} */
4377+
4378+/* {{{ normalize_varname
4379+ */
4380+static void normalize_varname(char *varname)
4381+{
4382+ char *s=varname, *index=NULL, *indexend=NULL, *p;
4383+
4384+ /* overjump leading space */
4385+ while (*s == ' ') {
4386+ s++;
4387+ }
4388+
4389+ /* and remove it */
4390+ if (s != varname) {
4391+ memmove(varname, s, strlen(s)+1);
4392+ }
4393+
4394+ for (p=varname; *p && *p != '['; p++) {
4395+ switch(*p) {
4396+ case ' ':
4397+ case '.':
4398+ *p='_';
4399+ break;
4400+ }
4401+ }
4402+
4403+ /* find index */
4404+ index = strchr(varname, '[');
4405+ if (index) {
4406+ index++;
4407+ s=index;
4408+ } else {
4409+ return;
4410+ }
4411+
4412+ /* done? */
4413+ while (index) {
4414+
4415+ while (*index == ' ' || *index == '\r' || *index == '\n' || *index=='\t') {
4416+ index++;
4417+ }
4418+ indexend = strchr(index, ']');
4419+ indexend = indexend ? indexend + 1 : index + strlen(index);
4420+
4421+ if (s != index) {
4422+ memmove(s, index, strlen(index)+1);
4423+ s += indexend-index;
4424+ } else {
4425+ s = indexend;
4426+ }
4427+
4428+ if (*s == '[') {
4429+ s++;
4430+ index = s;
4431+ } else {
4432+ index = NULL;
4433+ }
4434+ }
4435+ *s++='\0';
4436+}
4437+/* }}} */
4438+
4439+/* {{{ SAPI_UPLOAD_VARNAME_FILTER_FUNC
4440+ */
4441+SAPI_UPLOAD_VARNAME_FILTER_FUNC(varfilter_upload_varname_filter)
4442+{
4443+ char *index, *prev_index = NULL, *var;
4444+ unsigned int var_len, total_len, depth = 0;
4445+
4446+ var = estrdup(varname);
4447+
4448+ /* Normalize the variable name */
4449+ normalize_varname(var);
4450+
4451+ /* Find length of variable name */
4452+ index = strchr(var, '[');
4453+ total_len = strlen(var);
4454+ var_len = index ? index-var : total_len;
4455+
4456+ /* Drop this variable if it exceeds the varname/total length limit */
4457+ if (VARFILTER_G(max_varname_length) && VARFILTER_G(max_varname_length) < var_len) {
4458+ php_security_log(S_FILES, "configured request variable name length limit exceeded - dropped %s", var);
4459+ goto return_failure;
4460+ }
4461+ if (VARFILTER_G(max_totalname_length) && VARFILTER_G(max_totalname_length) < total_len) {
4462+ php_security_log(S_FILES, "configured request variable total name length limit exceeded - dropped %s", var);
4463+ goto return_failure;
4464+ }
4465+ if (VARFILTER_G(max_post_name_length) && VARFILTER_G(max_post_name_length) < var_len) {
4466+ php_security_log(S_FILES, "configured POST variable name length limit exceeded - dropped %s", var);
4467+
4468+ goto return_failure;
4469+ }
4470+ if (VARFILTER_G(max_post_totalname_length) && VARFILTER_G(max_post_totalname_length) < var_len) {
4471+ php_security_log(S_FILES, "configured POST variable total name length limit exceeded - dropped %s", var);
4472+ goto return_failure;
4473+ }
4474+
4475+ /* Find out array depth */
4476+ while (index) {
4477+ unsigned int index_length;
4478+
4479+ depth++;
4480+ index = strchr(index+1, '[');
4481+
4482+ if (prev_index) {
4483+ index_length = index ? index - 1 - prev_index - 1: strlen(prev_index);
4484+
4485+ if (VARFILTER_G(max_array_index_length) && VARFILTER_G(max_array_index_length) < index_length) {
4486+ php_security_log(S_FILES, "configured request variable array index length limit exceeded - dropped %s", var);
4487+ goto return_failure;
4488+ }
4489+ if (VARFILTER_G(max_post_array_index_length) && VARFILTER_G(max_post_array_index_length) < index_length) {
4490+ php_security_log(S_FILES, "configured POST variable array index length limit exceeded - dropped %s", var);
4491+ goto return_failure;
4492+ }
4493+ prev_index = index;
4494+ }
4495+
4496+ }
4497+
4498+ /* Drop this variable if it exceeds the array depth limit */
4499+ if (VARFILTER_G(max_array_depth) && VARFILTER_G(max_array_depth) < depth) {
4500+ php_security_log(S_FILES, "configured request variable array depth limit exceeded - dropped %s", var);
4501+ goto return_failure;
4502+ }
4503+ if (VARFILTER_G(max_post_array_depth) && VARFILTER_G(max_post_array_depth) < depth) {
4504+ php_security_log(S_FILES, "configured POST variable array depth limit exceeded - dropped %s", var);
4505+ goto return_failure;
4506+ }
4507+
4508+
4509+ /* Drop this variable if it is one of GLOBALS, _GET, _POST, ... */
4510+ /* This is to protect several silly scripts that do globalizing themself */
4511+
4512+ switch (var_len) {
4513+ case 18:
4514+ if (memcmp(var, "HTTP_RAW_POST_DATA", 18)==0) goto protected_varname2;
4515+ break;
4516+ case 17:
4517+ if (memcmp(var, "HTTP_SESSION_VARS", 17)==0) goto protected_varname2;
4518+ break;
4519+ case 16:
4520+ if (memcmp(var, "HTTP_SERVER_VARS", 16)==0) goto protected_varname2;
4521+ if (memcmp(var, "HTTP_COOKIE_VARS", 16)==0) goto protected_varname2;
4522+ break;
4523+ case 15:
4524+ if (memcmp(var, "HTTP_POST_FILES", 15)==0) goto protected_varname2;
4525+ break;
4526+ case 14:
4527+ if (memcmp(var, "HTTP_POST_VARS", 14)==0) goto protected_varname2;
4528+ break;
4529+ case 13:
4530+ if (memcmp(var, "HTTP_GET_VARS", 13)==0) goto protected_varname2;
4531+ if (memcmp(var, "HTTP_ENV_VARS", 13)==0) goto protected_varname2;
4532+ break;
4533+ case 8:
4534+ if (memcmp(var, "_SESSION", 8)==0) goto protected_varname2;
4535+ if (memcmp(var, "_REQUEST", 8)==0) goto protected_varname2;
4536+ break;
4537+ case 7:
4538+ if (memcmp(var, "GLOBALS", 7)==0) goto protected_varname2;
4539+ if (memcmp(var, "_COOKIE", 7)==0) goto protected_varname2;
4540+ if (memcmp(var, "_SERVER", 7)==0) goto protected_varname2;
4541+ break;
4542+ case 6:
4543+ if (memcmp(var, "_FILES", 6)==0) goto protected_varname2;
4544+ break;
4545+ case 5:
4546+ if (memcmp(var, "_POST", 5)==0) goto protected_varname2;
4547+ break;
4548+ case 4:
4549+ if (memcmp(var, "_ENV", 4)==0) goto protected_varname2;
4550+ if (memcmp(var, "_GET", 4)==0) goto protected_varname2;
4551+ break;
4552+ }
4553+
4554+ efree(var);
4555+ return SUCCESS;
4556+protected_varname2:
4557+ php_security_log(S_FILES, "tried to register forbidden variable '%s' through FILE variables", var);
4558+return_failure:
4559+ efree(var);
4560+ return FAILURE;
4561+}
4562+/* }}} */
4563+
4564+/* {{{ SAPI_PRE_UPLOAD_FILTER_FUNC
4565+ */
4566+SAPI_PRE_UPLOAD_FILTER_FUNC(varfilter_pre_upload_filter)
4567+{
4568+ /* Drop if no more variables flag is set */
4569+ if (VARFILTER_G(no_more_uploads)) {
4570+ return FAILURE;
4571+ }
4572+ /* Drop this fileupload if the limit is reached */
4573+ if (VARFILTER_G(max_uploads) && VARFILTER_G(max_uploads) <= VARFILTER_G(cur_uploads)) {
4574+ php_security_log(S_FILES, "configured fileupload limit exceeded - file dropped");
4575+ VARFILTER_G(no_more_uploads) = 1;
4576+ return FAILURE;
4577+ }
4578+
4579+ return SUCCESS;
4580+}
4581+/* }}} */
4582+
4583+/* {{{ SAPI_UPLOAD_CONTENT_FILTER_FUNC
4584+ */
4585+SAPI_UPLOAD_CONTENT_FILTER_FUNC(varfilter_upload_content_filter)
4586+{
4587+
4588+ if (VARFILTER_G(disallow_elf_files)) {
4589+
4590+ if (offset == 0 && buffer_len > 10) {
4591+
4592+ if (buffer[0] == 0x7F && buffer[1] == 'E' && buffer[2] == 'L' && buffer[3] == 'F') {
4593+ php_security_log(S_FILES, "uploaded file is an ELF executable - file dropped");
4594+ return FAILURE;
4595+ }
4596+ }
4597+
4598+ }
4599+
4600+ return SUCCESS;
4601+}
4602+/* }}} */
4603+
4604+/* {{{ SAPI_POST_UPLOAD_FILTER_FUNC
4605+ */
4606+SAPI_POST_UPLOAD_FILTER_FUNC(varfilter_post_upload_filter)
4607+{
4608+ int retval = SUCCESS;
4609+
4610+ if (VARFILTER_G(verification_script)) {
4611+ char cmd[8192];
4612+ FILE *in;
4613+ int first=1;
4614+
4615+ ap_php_snprintf(cmd, sizeof(cmd), "%s %s", VARFILTER_G(verification_script), tmpfilename);
4616+
4617+ if ((in=VCWD_POPEN(cmd, "r"))==NULL) {
4618+ php_security_log(S_FILES, "unable to execute fileupload verification script %s - file dropped", VARFILTER_G(verification_script));
4619+ return FAILURE;
4620+ }
4621+
4622+ retval = FAILURE;
4623+
4624+ /* read and forget the result */
4625+ while (1) {
4626+ int readbytes = fread(cmd, 1, sizeof(cmd), in);
4627+ if (readbytes<=0) {
4628+ break;
4629+ }
4630+ if (first) {
4631+ retval = atoi(cmd) == 1 ? SUCCESS : FAILURE;
4632+ first = 0;
4633+ }
4634+ }
4635+ pclose(in);
4636+ }
4637+
4638+ if (retval != SUCCESS) {
4639+ php_security_log(S_FILES, "fileupload verification script disallows file - file dropped");
4640+ return FAILURE;
4641+ }
4642+
4643+ VARFILTER_G(cur_uploads)++;
4644+ return SUCCESS;
4645+}
4646+/* }}} */
4647+
4648+/* {{{ SAPI_INPUT_FILTER_FUNC
4649+ */
4650+SAPI_INPUT_FILTER_FUNC(varfilter_input_filter)
4651+{
4652+ char *index, *prev_index = NULL;
4653+ unsigned int var_len, total_len, depth = 0;
4654+
4655+ /* Drop this variable if the limit was reached */
4656+ switch (arg) {
4657+ case PARSE_GET:
4658+ if (VARFILTER_G(no_more_get_variables)) {
4659+ return 0;
4660+ }
4661+ break;
4662+ case PARSE_POST:
4663+ if (VARFILTER_G(no_more_post_variables)) {
4664+ return 0;
4665+ }
4666+ break;
4667+ case PARSE_COOKIE:
4668+ if (VARFILTER_G(no_more_cookie_variables)) {
4669+ return 0;
4670+ }
4671+ break;
4672+ default: /* we do not want to protect parse_str() and friends */
4673+ if (new_val_len) {
4674+ *new_val_len = val_len;
4675+ }
4676+ return 1;
4677+ }
4678+ if (VARFILTER_G(no_more_variables)) {
4679+ return 0;
4680+ }
4681+
4682+ /* Drop this variable if the limit is now reached */
4683+ if (VARFILTER_G(max_request_variables) && VARFILTER_G(max_request_variables) <= VARFILTER_G(cur_request_variables)) {
4684+ php_security_log(S_VARS, "configured request variable limit exceeded - dropped %s", var);
4685+ VARFILTER_G(no_more_variables) = 1;
4686+ return 0;
4687+ }
4688+ switch (arg) {
4689+ case PARSE_GET:
4690+ if (VARFILTER_G(max_get_vars) && VARFILTER_G(max_get_vars) <= VARFILTER_G(cur_get_vars)) {
4691+ php_security_log(S_VARS, "configured GET variable limit exceeded - dropped %s", var);
4692+ VARFILTER_G(no_more_get_variables) = 1;
4693+ return 0;
4694+ }
4695+ break;
4696+ case PARSE_COOKIE:
4697+ if (VARFILTER_G(max_cookie_vars) && VARFILTER_G(max_cookie_vars) <= VARFILTER_G(cur_cookie_vars)) {
4698+ php_security_log(S_VARS, "configured COOKIE variable limit exceeded - dropped %s", var);
4699+ VARFILTER_G(no_more_cookie_variables) = 1;
4700+ return 0;
4701+ }
4702+ break;
4703+ case PARSE_POST:
4704+ if (VARFILTER_G(max_post_vars) && VARFILTER_G(max_post_vars) <= VARFILTER_G(cur_post_vars)) {
4705+ php_security_log(S_VARS, "configured POST variable limit exceeded - dropped %s", var);
4706+ VARFILTER_G(no_more_post_variables) = 1;
4707+ return 0;
4708+ }
4709+ break;
4710+ }
4711+
4712+
4713+ /* Drop this variable if it exceeds the value length limit */
4714+ if (VARFILTER_G(max_value_length) && VARFILTER_G(max_value_length) < val_len) {
4715+ php_security_log(S_VARS, "configured request variable value length limit exceeded - dropped %s", var);
4716+ return 0;
4717+ }
4718+ switch (arg) {
4719+ case PARSE_GET:
4720+ if (VARFILTER_G(max_get_value_length) && VARFILTER_G(max_get_value_length) < val_len) {
4721+ php_security_log(S_VARS, "configured GET variable value length limit exceeded - dropped %s", var);
4722+ return 0;
4723+ }
4724+ break;
4725+ case PARSE_COOKIE:
4726+ if (VARFILTER_G(max_cookie_value_length) && VARFILTER_G(max_cookie_value_length) < val_len) {
4727+ php_security_log(S_VARS, "configured COOKIE variable value length limit exceeded - dropped %s", var);
4728+ return 0;
4729+ }
4730+ break;
4731+ case PARSE_POST:
4732+ if (VARFILTER_G(max_post_value_length) && VARFILTER_G(max_post_value_length) < val_len) {
4733+ php_security_log(S_VARS, "configured POST variable value length limit exceeded - dropped %s", var);
4734+ return 0;
4735+ }
4736+ break;
4737+ }
4738+
4739+ /* Normalize the variable name */
4740+ normalize_varname(var);
4741+
4742+ /* Find length of variable name */
4743+ index = strchr(var, '[');
4744+ total_len = strlen(var);
4745+ var_len = index ? index-var : total_len;
4746+
4747+ /* Drop this variable if it exceeds the varname/total length limit */
4748+ if (VARFILTER_G(max_varname_length) && VARFILTER_G(max_varname_length) < var_len) {
4749+ php_security_log(S_VARS, "configured request variable name length limit exceeded - dropped %s", var);
4750+ return 0;
4751+ }
4752+ if (VARFILTER_G(max_totalname_length) && VARFILTER_G(max_totalname_length) < total_len) {
4753+ php_security_log(S_VARS, "configured request variable total name length limit exceeded - dropped %s", var);
4754+ return 0;
4755+ }
4756+ switch (arg) {
4757+ case PARSE_GET:
4758+ if (VARFILTER_G(max_get_name_length) && VARFILTER_G(max_get_name_length) < var_len) {
4759+ php_security_log(S_VARS, "configured GET variable name length limit exceeded - dropped %s", var);
4760+ return 0;
4761+ }
4762+ if (VARFILTER_G(max_get_totalname_length) && VARFILTER_G(max_get_totalname_length) < var_len) {
4763+ php_security_log(S_VARS, "configured GET variable total name length limit exceeded - dropped %s", var);
4764+ return 0;
4765+ }
4766+ break;
4767+ case PARSE_COOKIE:
4768+ if (VARFILTER_G(max_cookie_name_length) && VARFILTER_G(max_cookie_name_length) < var_len) {
4769+ php_security_log(S_VARS, "configured COOKIE variable name length limit exceeded - dropped %s", var);
4770+ return 0;
4771+ }
4772+ if (VARFILTER_G(max_cookie_totalname_length) && VARFILTER_G(max_cookie_totalname_length) < var_len) {
4773+ php_security_log(S_VARS, "configured COOKIE variable total name length limit exceeded - dropped %s", var);
4774+ return 0;
4775+ }
4776+ break;
4777+ case PARSE_POST:
4778+ if (VARFILTER_G(max_post_name_length) && VARFILTER_G(max_post_name_length) < var_len) {
4779+ php_security_log(S_VARS, "configured POST variable name length limit exceeded - dropped %s", var);
4780+ return 0;
4781+ }
4782+ if (VARFILTER_G(max_post_totalname_length) && VARFILTER_G(max_post_totalname_length) < var_len) {
4783+ php_security_log(S_VARS, "configured POST variable total name length limit exceeded - dropped %s", var);
4784+ return 0;
4785+ }
4786+ break;
4787+ }
4788+
4789+ /* Find out array depth */
4790+ while (index) {
4791+ unsigned int index_length;
4792+
4793+ depth++;
4794+ index = strchr(index+1, '[');
4795+
4796+ if (prev_index) {
4797+ index_length = index ? index - 1 - prev_index - 1: strlen(prev_index);
4798+
4799+ if (VARFILTER_G(max_array_index_length) && VARFILTER_G(max_array_index_length) < index_length) {
4800+ php_security_log(S_VARS, "configured request variable array index length limit exceeded - dropped %s", var);
4801+ return 0;
4802+ }
4803+ switch (arg) {
4804+ case PARSE_GET:
4805+ if (VARFILTER_G(max_get_array_index_length) && VARFILTER_G(max_get_array_index_length) < index_length) {
4806+ php_security_log(S_VARS, "configured GET variable array index length limit exceeded - dropped %s", var);
4807+ return 0;
4808+ }
4809+ break;
4810+ case PARSE_COOKIE:
4811+ if (VARFILTER_G(max_cookie_array_index_length) && VARFILTER_G(max_cookie_array_index_length) < index_length) {
4812+ php_security_log(S_VARS, "configured COOKIE variable array index length limit exceeded - dropped %s", var);
4813+ return 0;
4814+ }
4815+ break;
4816+ case PARSE_POST:
4817+ if (VARFILTER_G(max_post_array_index_length) && VARFILTER_G(max_post_array_index_length) < index_length) {
4818+ php_security_log(S_VARS, "configured POST variable array index length limit exceeded - dropped %s", var);
4819+ return 0;
4820+ }
4821+ break;
4822+ }
4823+ prev_index = index;
4824+ }
4825+
4826+ }
4827+
4828+ /* Drop this variable if it exceeds the array depth limit */
4829+ if (VARFILTER_G(max_array_depth) && VARFILTER_G(max_array_depth) < depth) {
4830+ php_security_log(S_VARS, "configured request variable array depth limit exceeded - dropped %s", var);
4831+ return 0;
4832+ }
4833+ switch (arg) {
4834+ case PARSE_GET:
4835+ if (VARFILTER_G(max_get_array_depth) && VARFILTER_G(max_get_array_depth) < depth) {
4836+ php_security_log(S_VARS, "configured GET variable array depth limit exceeded - dropped %s", var);
4837+ return 0;
4838+ }
4839+ break;
4840+ case PARSE_COOKIE:
4841+ if (VARFILTER_G(max_cookie_array_depth) && VARFILTER_G(max_cookie_array_depth) < depth) {
4842+ php_security_log(S_VARS, "configured COOKIE variable array depth limit exceeded - dropped %s", var);
4843+ return 0;
4844+ }
4845+ break;
4846+ case PARSE_POST:
4847+ if (VARFILTER_G(max_post_array_depth) && VARFILTER_G(max_post_array_depth) < depth) {
4848+ php_security_log(S_VARS, "configured POST variable array depth limit exceeded - dropped %s", var);
4849+ return 0;
4850+ }
4851+ break;
4852+ }
4853+
4854+ /* Check if variable value is truncated by a \0 */
4855+
4856+ if (val && *val && val_len != strlen(*val)) {
4857+
4858+ if (VARFILTER_G(disallow_nul)) {
4859+ php_security_log(S_VARS, "ASCII-NUL chars not allowed within request variables - dropped %s", var);
4860+ return 0;
4861+ }
4862+ switch (arg) {
4863+ case PARSE_GET:
4864+ if (VARFILTER_G(disallow_get_nul)) {
4865+ php_security_log(S_VARS, "ASCII-NUL chars not allowed within GET variables - dropped %s", var);
4866+ return 0;
4867+ }
4868+ break;
4869+ case PARSE_COOKIE:
4870+ if (VARFILTER_G(disallow_cookie_nul)) {
4871+ php_security_log(S_VARS, "ASCII-NUL chars not allowed within COOKIE variables - dropped %s", var);
4872+ return 0;
4873+ }
4874+ break;
4875+ case PARSE_POST:
4876+ if (VARFILTER_G(disallow_post_nul)) {
4877+ php_security_log(S_VARS, "ASCII-NUL chars not allowed within POST variables - dropped %s", var);
4878+ return 0;
4879+ }
4880+ break;
4881+ }
4882+ }
4883+
4884+ /* Drop this variable if it is one of GLOBALS, _GET, _POST, ... */
4885+ /* This is to protect several silly scripts that do globalizing themself */
4886+
4887+ switch (var_len) {
4888+ case 18:
4889+ if (memcmp(var, "HTTP_RAW_POST_DATA", 18)==0) goto protected_varname;
4890+ break;
4891+ case 17:
4892+ if (memcmp(var, "HTTP_SESSION_VARS", 17)==0) goto protected_varname;
4893+ break;
4894+ case 16:
4895+ if (memcmp(var, "HTTP_SERVER_VARS", 16)==0) goto protected_varname;
4896+ if (memcmp(var, "HTTP_COOKIE_VARS", 16)==0) goto protected_varname;
4897+ break;
4898+ case 15:
4899+ if (memcmp(var, "HTTP_POST_FILES", 15)==0) goto protected_varname;
4900+ break;
4901+ case 14:
4902+ if (memcmp(var, "HTTP_POST_VARS", 14)==0) goto protected_varname;
4903+ break;
4904+ case 13:
4905+ if (memcmp(var, "HTTP_GET_VARS", 13)==0) goto protected_varname;
4906+ if (memcmp(var, "HTTP_ENV_VARS", 13)==0) goto protected_varname;
4907+ break;
4908+ case 8:
4909+ if (memcmp(var, "_SESSION", 8)==0) goto protected_varname;
4910+ if (memcmp(var, "_REQUEST", 8)==0) goto protected_varname;
4911+ break;
4912+ case 7:
4913+ if (memcmp(var, "GLOBALS", 7)==0) goto protected_varname;
4914+ if (memcmp(var, "_COOKIE", 7)==0) goto protected_varname;
4915+ if (memcmp(var, "_SERVER", 7)==0) goto protected_varname;
4916+ break;
4917+ case 6:
4918+ if (memcmp(var, "_FILES", 6)==0) goto protected_varname;
4919+ break;
4920+ case 5:
4921+ if (memcmp(var, "_POST", 5)==0) goto protected_varname;
4922+ break;
4923+ case 4:
4924+ if (memcmp(var, "_ENV", 4)==0) goto protected_varname;
4925+ if (memcmp(var, "_GET", 4)==0) goto protected_varname;
4926+ break;
4927+ }
4928+
4929+ /* Okay let PHP register this variable */
4930+ VARFILTER_G(cur_request_variables)++;
4931+ switch (arg) {
4932+ case PARSE_GET:
4933+ VARFILTER_G(cur_get_vars)++;
4934+ break;
4935+ case PARSE_COOKIE:
4936+ VARFILTER_G(cur_cookie_vars)++;
4937+ break;
4938+ case PARSE_POST:
4939+ VARFILTER_G(cur_post_vars)++;
4940+ break;
4941+ }
4942+
4943+ if (new_val_len) {
4944+ *new_val_len = val_len;
4945+ }
4946+
4947+ return 1;
4948+protected_varname:
4949+ php_security_log(S_VARS, "tried to register forbidden variable '%s' through %s variables", var, arg == PARSE_GET ? "GET" : arg == PARSE_POST ? "POST" : "COOKIE");
4950+ return 0;
4951+}
4952+/* }}} */
4953+
4954+/*
4955+ * Local variables:
4956+ * tab-width: 4
4957+ * c-basic-offset: 4
4958+ * End:
4959+ * vim600: noet sw=4 ts=4 fdm=marker
4960+ * vim<600: noet sw=4 ts=4
4961+ */
4962+
4963+
4964diff -Nura php-4.4.2/ext/wddx/wddx.c hardening-patch-4.4.2-0.4.15/ext/wddx/wddx.c
4965--- php-4.4.2/ext/wddx/wddx.c 2006-01-01 14:46:59.000000000 +0100
4966+++ hardening-patch-4.4.2-0.4.15/ext/wddx/wddx.c 2006-09-05 20:30:33.000000000 +0200
4967@@ -16,7 +16,11 @@
4968 +----------------------------------------------------------------------+
4969 */
4970
4971-/* $Id: wddx.c,v 1.96.2.6.2.3 2006/01/01 13:46:59 sniper Exp $ */
4972+/* $Id: wddx.c,v 1.96.2.6.2.7 2006/05/26 01:55:26 iliaa Exp $ */
4973+
4974+#ifdef HAVE_CONFIG_H
4975+#include "config.h"
4976+#endif
4977
4978 #include "php.h"
4979 #include "php_wddx.h"
4980@@ -400,9 +404,9 @@
4981 break;
4982
4983 default:
4984- if (iscntrl((int)*(unsigned char *)p)) {
4985+ if (iscntrl((int)*(unsigned char *)p) || (int)*(unsigned char *)p >= 127) {
4986 FLUSH_BUF();
4987- sprintf(control_buf, WDDX_CHAR, *p);
4988+ sprintf(control_buf, WDDX_CHAR, (int)*(unsigned char *)p);
4989 php_wddx_add_chunk(packet, control_buf);
4990 } else
4991 buf[l++] = *p;
4992@@ -428,7 +432,7 @@
4993 tmp = *var;
4994 zval_copy_ctor(&tmp);
4995 convert_to_string(&tmp);
4996- sprintf(tmp_buf, WDDX_NUMBER, Z_STRVAL(tmp));
4997+ snprintf(tmp_buf, Z_STRLEN(tmp), WDDX_NUMBER, Z_STRVAL(tmp));
4998 zval_dtor(&tmp);
4999
5000 php_wddx_add_chunk(packet, tmp_buf);
5001@@ -620,17 +624,19 @@
5002 */
5003 void php_wddx_serialize_var(wddx_packet *packet, zval *var, char *name, int name_len TSRMLS_DC)
5004 {
5005- char tmp_buf[WDDX_BUF_LEN];
5006+ char *tmp_buf;
5007 char *name_esc;
5008 int name_esc_len;
5009
5010 if (name) {
5011 name_esc = php_escape_html_entities(name, name_len, &name_esc_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
5012- sprintf(tmp_buf, WDDX_VAR_S, name_esc);
5013+ tmp_buf = emalloc(name_esc_len + 1);
5014+ snprintf(tmp_buf, name_esc_len, WDDX_VAR_S, name_esc);
5015 php_wddx_add_chunk(packet, tmp_buf);
5016+ efree(tmp_buf);
5017 efree(name_esc);
5018 }
5019-
5020+
5021 switch(Z_TYPE_P(var)) {
5022 case IS_STRING:
5023 php_wddx_serialize_string(packet, var);
5024diff -Nura php-4.4.2/main/fopen_wrappers.c hardening-patch-4.4.2-0.4.15/main/fopen_wrappers.c
5025--- php-4.4.2/main/fopen_wrappers.c 2006-01-01 14:46:59.000000000 +0100
5026+++ hardening-patch-4.4.2-0.4.15/main/fopen_wrappers.c 2006-09-07 18:53:23.000000000 +0200
5027@@ -106,7 +106,10 @@
5028 }
5029
5030 /* Resolve the real path into resolved_name */
5031- if ((expand_filepath(path, resolved_name TSRMLS_CC) != NULL) && (expand_filepath(local_open_basedir, resolved_basedir TSRMLS_CC) != NULL)) {
5032+ if (expand_filepath(path, resolved_name TSRMLS_CC) == NULL) {
5033+ return -2;
5034+ }
5035+ if (expand_filepath(local_open_basedir, resolved_basedir TSRMLS_CC) != NULL) {
5036 /* Handler for basedirs that end with a / */
5037 resolved_basedir_len = strlen(resolved_basedir);
5038 if (basedir[strlen(basedir) - 1] == PHP_DIR_SEPARATOR) {
5039@@ -116,14 +119,20 @@
5040 }
5041 }
5042
5043+ resolved_name_len = strlen(resolved_name);
5044 if (path[strlen(path)-1] == PHP_DIR_SEPARATOR) {
5045- resolved_name_len = strlen(resolved_name);
5046 if (resolved_name[resolved_name_len - 1] != PHP_DIR_SEPARATOR) {
5047 resolved_name[resolved_name_len] = PHP_DIR_SEPARATOR;
5048 resolved_name[++resolved_name_len] = '\0';
5049 }
5050 }
5051
5052+ if (resolved_name_len == resolved_basedir_len - 1) {
5053+ if (resolved_basedir[resolved_basedir_len - 1] == PHP_DIR_SEPARATOR) {
5054+ resolved_basedir_len--;
5055+ }
5056+ }
5057+
5058 /* Check the path */
5059 #ifdef PHP_WIN32
5060 if (strncasecmp(resolved_basedir, resolved_name, resolved_basedir_len) == 0) {
5061@@ -137,7 +146,7 @@
5062 }
5063 } else {
5064 /* Unable to resolve the real path, return -1 */
5065- return -1;
5066+ return -3;
5067 }
5068 }
5069 /* }}} */
5070@@ -156,22 +165,44 @@
5071 char *pathbuf;
5072 char *ptr;
5073 char *end;
5074+ char path_copy[MAXPATHLEN];
5075+ int path_len;
5076+
5077+ /* Special case path ends with a trailing slash */
5078+ path_len = strlen(path);
5079+ if (path_len >= MAXPATHLEN) {
5080+ errno = EPERM; /* we deny permission to open it */
5081+ return -1;
5082+ }
5083+ if (path_len > 0 && path[path_len-1] == PHP_DIR_SEPARATOR) {
5084+ memcpy(path_copy, path, path_len+1);
5085+ while (path_len > 0 && path_copy[path_len-1] == PHP_DIR_SEPARATOR) path_len--;
5086+ path_copy[path_len] = '\0';
5087+ path = (const char *)&path_copy;
5088+ }
5089
5090 pathbuf = estrdup(PG(open_basedir));
5091
5092 ptr = pathbuf;
5093
5094 while (ptr && *ptr) {
5095+ int res;
5096 end = strchr(ptr, DEFAULT_DIR_SEPARATOR);
5097 if (end != NULL) {
5098 *end = '\0';
5099 end++;
5100 }
5101
5102- if (php_check_specific_open_basedir(ptr, path TSRMLS_CC) == 0) {
5103+ res = php_check_specific_open_basedir(ptr, path TSRMLS_CC);
5104+ if (res == 0) {
5105 efree(pathbuf);
5106 return 0;
5107 }
5108+ if (res == -2) {
5109+ efree(pathbuf);
5110+ errno = EPERM;
5111+ return -1;
5112+ }
5113
5114 ptr = end;
5115 }
5116diff -Nura php-4.4.2/main/hardened_globals.h hardening-patch-4.4.2-0.4.15/main/hardened_globals.h
5117--- php-4.4.2/main/hardened_globals.h 1970-01-01 01:00:00.000000000 +0100
5118+++ hardening-patch-4.4.2-0.4.15/main/hardened_globals.h 2006-09-05 20:30:33.000000000 +0200
5119@@ -0,0 +1,64 @@
5120+/*
5121+ +----------------------------------------------------------------------+
5122+ | Hardening-Patch for PHP |
5123+ +----------------------------------------------------------------------+
5124+ | Copyright (c) 2004-2005 Stefan Esser |
5125+ +----------------------------------------------------------------------+
5126+ | This source file is subject to version 2.02 of the PHP license, |
5127+ | that is bundled with this package in the file LICENSE, and is |
5128+ | available at through the world-wide-web at |
5129+ | http://www.php.net/license/2_02.txt. |
5130+ | If you did not receive a copy of the PHP license and are unable to |
5131+ | obtain it through the world-wide-web, please send a note to |
5132+ | license@php.net so we can mail you a copy immediately. |
5133+ +----------------------------------------------------------------------+
5134+ | Author: Stefan Esser <sesser@hardened-php.net> |
5135+ +----------------------------------------------------------------------+
5136+ */
5137+
5138+#ifndef HARDENED_GLOBALS_H
5139+#define HARDENED_GLOBALS_H
5140+
5141+typedef struct _hardened_globals hardened_globals_struct;
5142+
5143+#ifdef ZTS
5144+# define HG(v) TSRMG(hardened_globals_id, hardened_globals_struct *, v)
5145+extern int hardened_globals_id;
5146+#else
5147+# define HG(v) (hardened_globals.v)
5148+extern struct _hardened_globals hardened_globals;
5149+#endif
5150+
5151+
5152+struct _hardened_globals {
5153+#if HARDENING_PATCH_MM_PROTECT
5154+ unsigned int canary_1;
5155+ unsigned int canary_2;
5156+#endif
5157+#if HARDENING_PATCH_LL_PROTECT
5158+ unsigned int canary_3;
5159+ unsigned int canary_4;
5160+ unsigned int ll_canary_inited;
5161+#endif
5162+ zend_bool hphp_sql_bailout_on_error;
5163+ zend_bool hphp_multiheader;
5164+ unsigned long hphp_mailprotect;
5165+ long hard_memory_limit;
5166+ HashTable *eval_whitelist;
5167+ HashTable *eval_blacklist;
5168+ HashTable *func_whitelist;
5169+ HashTable *func_blacklist;
5170+ HashTable *include_whitelist;
5171+ HashTable *include_blacklist;
5172+ unsigned int dummy;
5173+};
5174+
5175+
5176+#endif /* HARDENED_GLOBALS_H */
5177+
5178+/*
5179+ * Local variables:
5180+ * tab-width: 4
5181+ * c-basic-offset: 4
5182+ * End:
5183+ */
5184diff -Nura php-4.4.2/main/hardening_patch.c hardening-patch-4.4.2-0.4.15/main/hardening_patch.c
5185--- php-4.4.2/main/hardening_patch.c 1970-01-01 01:00:00.000000000 +0100
5186+++ hardening-patch-4.4.2-0.4.15/main/hardening_patch.c 2006-09-07 18:48:28.000000000 +0200
5187@@ -0,0 +1,430 @@
5188+/*
5189+ +----------------------------------------------------------------------+
5190+ | Hardening Patch for PHP |
5191+ +----------------------------------------------------------------------+
5192+ | Copyright (c) 2004-2005 Stefan Esser |
5193+ +----------------------------------------------------------------------+
5194+ | This source file is subject to version 2.02 of the PHP license, |
5195+ | that is bundled with this package in the file LICENSE, and is |
5196+ | available at through the world-wide-web at |
5197+ | http://www.php.net/license/2_02.txt. |
5198+ | If you did not receive a copy of the PHP license and are unable to |
5199+ | obtain it through the world-wide-web, please send a note to |
5200+ | license@php.net so we can mail you a copy immediately. |
5201+ +----------------------------------------------------------------------+
5202+ | Author: Stefan Esser <sesser@hardened-php.net> |
5203+ +----------------------------------------------------------------------+
5204+ */
5205+/* $Id: hardening_patch.c,v 1.2 2004/11/21 09:38:52 ionic Exp $ */
5206+
5207+#include "php.h"
5208+
5209+#include <stdio.h>
5210+#include <stdlib.h>
5211+
5212+#if HAVE_UNISTD_H
5213+#include <unistd.h>
5214+#endif
5215+#include "SAPI.h"
5216+#include "php_globals.h"
5217+
5218+#if HARDENING_PATCH
5219+
5220+#ifdef HAVE_SYS_SOCKET_H
5221+#include <sys/socket.h>
5222+#endif
5223+
5224+#if defined(PHP_WIN32) || defined(__riscos__) || defined(NETWARE)
5225+#undef AF_UNIX
5226+#endif
5227+
5228+#if defined(AF_UNIX)
5229+#include <sys/un.h>
5230+#endif
5231+
5232+#define SYSLOG_PATH "/dev/log"
5233+
5234+#include "snprintf.h"
5235+
5236+#include "hardening_patch.h"
5237+
5238+#ifdef ZTS
5239+#include "hardened_globals.h"
5240+int hardened_globals_id;
5241+#else
5242+struct _hardened_globals hardened_globals;
5243+#endif
5244+
5245+static void hardened_globals_ctor(hardened_globals_struct *hardened_globals TSRMLS_DC)
5246+{
5247+ memset(hardened_globals, 0, sizeof(*hardened_globals));
5248+}
5249+
5250+
5251+PHPAPI void hardened_startup()
5252+{
5253+#ifdef ZTS
5254+ ts_allocate_id(&hardened_globals_id, sizeof(hardened_globals_struct), (ts_allocate_ctor) hardened_globals_ctor, NULL);
5255+#else
5256+ hardened_globals_ctor(&hardened_globals TSRMLS_CC);
5257+#endif
5258+}
5259+
5260+PHPAPI void hardened_clear_mm_canaries(TSRMLS_D)
5261+{
5262+ HG(canary_1) = php_canary();
5263+ HG(canary_2) = php_canary();
5264+}
5265+
5266+char *loglevel2string(int loglevel)
5267+{
5268+ switch (loglevel) {
5269+ case S_FILES:
5270+ return "FILES";
5271+ case S_INCLUDE:
5272+ return "INCLUDE";
5273+ case S_MEMORY:
5274+ return "MEMORY";
5275+ case S_MISC:
5276+ return "MISC";
5277+ case S_SQL:
5278+ return "SQL";
5279+ case S_EXECUTOR:
5280+ return "EXECUTOR";
5281+ case S_VARS:
5282+ return "VARS";
5283+ default:
5284+ return "UNKNOWN";
5285+ }
5286+}
5287+
5288+PHPAPI void php_security_log(int loglevel, char *fmt, ...)
5289+{
5290+#if defined(AF_UNIX)
5291+ int s, r, i=0;
5292+ struct sockaddr_un saun;
5293+ char buf[4096+64];
5294+ char error[4096+100];
5295+ char *ip_address;
5296+ char *fname;
5297+ int lineno;
5298+ va_list ap;
5299+ TSRMLS_FETCH();
5300+
5301+ if (EG(hphp_log_use_x_forwarded_for)) {
5302+ ip_address = sapi_getenv("HTTP_X_FORWARDED_FOR", 20 TSRMLS_CC);
5303+ if (ip_address == NULL) {
5304+ ip_address = "X-FORWARDED-FOR not set";
5305+ }
5306+ } else {
5307+ ip_address = sapi_getenv("REMOTE_ADDR", 11 TSRMLS_CC);
5308+ if (ip_address == NULL) {
5309+ ip_address = "REMOTE_ADDR not set";
5310+ }
5311+ }
5312+
5313+
5314+ va_start(ap, fmt);
5315+ ap_php_vsnprintf(error, sizeof(error), fmt, ap);
5316+ va_end(ap);
5317+ while (error[i]) {
5318+ if (error[i] < 32) error[i] = '.';
5319+ i++;
5320+ }
5321+
5322+ if (zend_is_executing(TSRMLS_C)) {
5323+ lineno = zend_get_executed_lineno(TSRMLS_C);
5324+ fname = zend_get_executed_filename(TSRMLS_C);
5325+ ap_php_snprintf(buf, sizeof(buf), "ALERT - %s (attacker '%s', file '%s', line %u)", error, ip_address, fname, lineno);
5326+ } else {
5327+ fname = sapi_getenv("SCRIPT_FILENAME", 15 TSRMLS_CC);
5328+ if (fname==NULL) {
5329+ fname = "unknown";
5330+ }
5331+ ap_php_snprintf(buf, sizeof(buf), "ALERT - %s (attacker '%s', file '%s')", error, ip_address, fname);
5332+ }
5333+
5334+ /* Syslog-Logging disabled? */
5335+ if ((EG(hphp_log_syslog) & loglevel)==0) {
5336+ goto log_sapi;
5337+ }
5338+
5339+ ap_php_snprintf(error, sizeof(error), "<%u>hphp[%u]: %s\n", EG(hphp_log_syslog_facility)|EG(hphp_log_syslog_priority),getpid(),buf);
5340+
5341+ s = socket(AF_UNIX, SOCK_DGRAM, 0);
5342+ if (s == -1) {
5343+ goto log_sapi;
5344+ }
5345+
5346+ memset(&saun, 0, sizeof(saun));
5347+ saun.sun_family = AF_UNIX;
5348+ strcpy(saun.sun_path, SYSLOG_PATH);
5349+ /*saun.sun_len = sizeof(saun);*/
5350+
5351+ r = connect(s, (struct sockaddr *)&saun, sizeof(saun));
5352+ if (r) {
5353+ close(s);
5354+ s = socket(AF_UNIX, SOCK_STREAM, 0);
5355+ if (s == -1) {
5356+ goto log_sapi;
5357+ }
5358+
5359+ memset(&saun, 0, sizeof(saun));
5360+ saun.sun_family = AF_UNIX;
5361+ strcpy(saun.sun_path, SYSLOG_PATH);
5362+ /*saun.sun_len = sizeof(saun);*/
5363+
5364+ r = connect(s, (struct sockaddr *)&saun, sizeof(saun));
5365+ if (r) {
5366+ close(s);
5367+ goto log_sapi;
5368+ }
5369+ }
5370+ send(s, error, strlen(error), 0);
5371+
5372+ close(s);
5373+
5374+log_sapi:
5375+ /* SAPI Logging activated? */
5376+ if ((EG(hphp_log_sapi) & loglevel)!=0) {
5377+ sapi_module.log_message(buf);
5378+ }
5379+
5380+log_script:
5381+ /* script logging activaed? */
5382+ if (((EG(hphp_log_script) & loglevel)!=0) && EG(hphp_log_scriptname)!=NULL) {
5383+ char cmd[8192], *cmdpos, *bufpos;
5384+ FILE *in;
5385+ int space;
5386+
5387+ ap_php_snprintf(cmd, sizeof(cmd), "%s %s \'", EG(hphp_log_scriptname), loglevel2string(loglevel));
5388+ space = sizeof(cmd) - strlen(cmd);
5389+ cmdpos = cmd + strlen(cmd);
5390+ bufpos = buf;
5391+ if (space <= 1) return;
5392+ while (space > 2 && *bufpos) {
5393+ if (*bufpos == '\'') {
5394+ if (space<=5) break;
5395+ *cmdpos++ = '\'';
5396+ *cmdpos++ = '\\';
5397+ *cmdpos++ = '\'';
5398+ *cmdpos++ = '\'';
5399+ bufpos++;
5400+ space-=4;
5401+ } else {
5402+ *cmdpos++ = *bufpos++;
5403+ space--;
5404+ }
5405+ }
5406+ *cmdpos++ = '\'';
5407+ *cmdpos = 0;
5408+
5409+ if ((in=VCWD_POPEN(cmd, "r"))==NULL) {
5410+ php_security_log(S_INTERNAL, "Unable to execute logging shell script: %s", EG(hphp_log_scriptname));
5411+ return;
5412+ }
5413+ /* read and forget the result */
5414+ while (1) {
5415+ int readbytes = fread(cmd, 1, sizeof(cmd), in);
5416+ if (readbytes<=0) {
5417+ break;
5418+ }
5419+ }
5420+ pclose(in);
5421+ }
5422+
5423+#endif
5424+}
5425+#endif
5426+
5427+#if HARDENING_PATCH_MM_PROTECT || HARDENING_PATCH_LL_PROTECT || HARDENING_PATCH_HASH_PROTECT
5428+
5429+/* will be replaced later with more compatible method */
5430+PHPAPI unsigned int php_canary()
5431+{
5432+ time_t t;
5433+ unsigned int canary;
5434+ int fd;
5435+
5436+ fd = open("/dev/urandom", 0);
5437+ if (fd != -1) {
5438+ int r = read(fd, &canary, sizeof(canary));
5439+ close(fd);
5440+ if (r == sizeof(canary)) {
5441+ return (canary);
5442+ }
5443+ }
5444+ /* not good but we never want to do this */
5445+ time(&t);
5446+ canary = *(unsigned int *)&t + getpid() << 16;
5447+ return (canary);
5448+}
5449+#endif
5450+
5451+#if HARDENING_PATCH_INC_PROTECT
5452+
5453+PHPAPI int php_is_valid_include(zval *z)
5454+{
5455+ char *filename;
5456+ int len, i;
5457+ TSRMLS_FETCH();
5458+
5459+ /* must be of type string */
5460+ if (z->type != IS_STRING || z->value.str.val == NULL) {
5461+ return (0);
5462+ }
5463+
5464+ /* short cut */
5465+ filename = z->value.str.val;
5466+ len = z->value.str.len;
5467+
5468+ /* 1. must be shorter than MAXPATHLEN */
5469+ if (len > MAXPATHLEN) {
5470+ char *fname = estrndup(filename, len);
5471+ for (i=0; i < len; i++) if (fname[i] < 32) fname[i]='.';
5472+ php_security_log(S_INCLUDE, "Include filename ('%s') longer than MAXPATHLEN chars", fname);
5473+ efree(fname);
5474+ return (0);
5475+ }
5476+
5477+ /* 2. must not be cutted */
5478+ if (len != strlen(filename)) {
5479+ char *fname = estrndup(filename, len);
5480+ for (i=0; fname[i]; i++) if (fname[i] < 32) fname[i]='.';
5481+ php_security_log(S_INCLUDE, "Include filename truncated by a \\0 after '%s'", fname);
5482+ efree(fname);
5483+ return (0);
5484+ }
5485+
5486+ /* 3. when it is an URL first check black/whitelist if both are empty disallow all URLs */
5487+ if (strstr(filename, "://")) {
5488+ char *fname = estrndup(filename, len);
5489+ for (i=0; i < len; i++) if (fname[i] < 32) fname[i]='.';
5490+
5491+ /* no black or whitelist then disallow all */
5492+ if (HG(include_whitelist)==NULL && HG(include_blacklist)==NULL) {
5493+ php_security_log(S_INCLUDE, "Include filename ('%s') is an URL", fname);
5494+ efree(fname);
5495+ return (0);
5496+ }
5497+
5498+ /* whitelist is stronger than blacklist */
5499+ if (HG(include_whitelist)) {
5500+ char *s, *t, *h, *index;
5501+ uint indexlen;
5502+ ulong numindex;
5503+
5504+ s = filename;
5505+
5506+ do {
5507+ zend_bool isOk = 0;
5508+ int tlen;
5509+
5510+ t = h = strstr(s, "://");
5511+ if (h == NULL) break;
5512+
5513+
5514+ while (t > s && (isalnum(t[-1]) || t[-1]=='_')) {
5515+ t--;
5516+ }
5517+
5518+ tlen = strlen(t);
5519+
5520+ zend_hash_internal_pointer_reset(HG(include_whitelist));
5521+ do {
5522+ int r = zend_hash_get_current_key_ex(HG(include_whitelist), &index, &indexlen, &numindex, 0, NULL);
5523+
5524+ if (r==HASH_KEY_NON_EXISTANT) {
5525+ break;
5526+ }
5527+ if (r==HASH_KEY_IS_STRING) {
5528+ if (h-t <= indexlen-1 && tlen>=indexlen-1) {
5529+ if (strncmp(t, index, indexlen-1)==0) {
5530+ isOk = 1;
5531+ break;
5532+ }
5533+ }
5534+ }
5535+
5536+ zend_hash_move_forward(HG(include_whitelist));
5537+ } while (1);
5538+
5539+ /* not found in whitelist */
5540+ if (!isOk) {
5541+ php_security_log(S_INCLUDE, "Include filename ('%s') is an URL that is not allowed in whitelist", fname);
5542+ efree(fname);
5543+ return 0;
5544+ }
5545+
5546+ s = h + 3;
5547+ } while (1);
5548+ } else {
5549+ /* okay then handle the blacklist */
5550+ char *s, *t, *h, *index;
5551+ uint indexlen;
5552+ ulong numindex;
5553+
5554+ s = filename;
5555+
5556+ do {
5557+ int tlen;
5558+
5559+ t = h = strstr(s, "://");
5560+ if (h == NULL) break;
5561+
5562+
5563+ while (t > s && (isalnum(t[-1]) || t[-1]=='_')) {
5564+ t--;
5565+ }
5566+
5567+ tlen = strlen(t);
5568+
5569+ zend_hash_internal_pointer_reset(HG(include_blacklist));
5570+ do {
5571+ int r = zend_hash_get_current_key_ex(HG(include_blacklist), &index, &indexlen, &numindex, 0, NULL);
5572+
5573+ if (r==HASH_KEY_NON_EXISTANT) {
5574+ break;
5575+ }
5576+ if (r==HASH_KEY_IS_STRING) {
5577+ if (h-t <= indexlen-1 && tlen>=indexlen-1) {
5578+ if (strncmp(t, index, indexlen-1)==0) {
5579+ php_security_log(S_INCLUDE, "Include filename ('%s') is an URL that is forbidden by the blacklist", fname);
5580+ efree(fname);
5581+ return 0;
5582+ }
5583+ }
5584+ }
5585+
5586+ zend_hash_move_forward(HG(include_blacklist));
5587+ } while (1);
5588+
5589+ s = h + 3;
5590+ } while (1);
5591+ }
5592+
5593+ efree(fname);
5594+ }
5595+
5596+ /* 4. must not be an uploaded file */
5597+ if (SG(rfc1867_uploaded_files)) {
5598+ if (zend_hash_exists(SG(rfc1867_uploaded_files), (char *) filename, len+1)) {
5599+ php_security_log(S_INCLUDE, "Include filename is an uploaded file");
5600+ return (0);
5601+ }
5602+ }
5603+
5604+ /* passed all tests */
5605+ return (1);
5606+}
5607+
5608+#endif
5609+
5610+/*
5611+ * Local variables:
5612+ * tab-width: 4
5613+ * c-basic-offset: 4
5614+ * End:
5615+ * vim600: sw=4 ts=4 fdm=marker
5616+ * vim<600: sw=4 ts=4
5617+ */
5618diff -Nura php-4.4.2/main/hardening_patch.h hardening-patch-4.4.2-0.4.15/main/hardening_patch.h
5619--- php-4.4.2/main/hardening_patch.h 1970-01-01 01:00:00.000000000 +0100
5620+++ hardening-patch-4.4.2-0.4.15/main/hardening_patch.h 2006-09-07 18:48:35.000000000 +0200
5621@@ -0,0 +1,46 @@
5622+/*
5623+ +----------------------------------------------------------------------+
5624+ | Hardening Patch for PHP |
5625+ +----------------------------------------------------------------------+
5626+ | Copyright (c) 2004-2005 Stefan Esser |
5627+ +----------------------------------------------------------------------+
5628+ | This source file is subject to version 2.02 of the PHP license, |
5629+ | that is bundled with this package in the file LICENSE, and is |
5630+ | available at through the world-wide-web at |
5631+ | http://www.php.net/license/2_02.txt. |
5632+ | If you did not receive a copy of the PHP license and are unable to |
5633+ | obtain it through the world-wide-web, please send a note to |
5634+ | license@php.net so we can mail you a copy immediately. |
5635+ +----------------------------------------------------------------------+
5636+ | Author: Stefan Esser <sesser@hardened-php.net> |
5637+ +----------------------------------------------------------------------+
5638+ */
5639+
5640+#ifndef HARDENING_PATCH_H
5641+#define HARDENING_PATCH_H
5642+
5643+#include "zend.h"
5644+
5645+#if HARDENING_PATCH
5646+PHPAPI void php_security_log(int loglevel, char *fmt, ...);
5647+PHPAPI void hardened_startup();
5648+#define HARDENING_PATCH_VERSION "0.4.15"
5649+
5650+#endif
5651+
5652+#if HARDENING_PATCH_MM_PROTECT || HARDENING_PATCH_LL_PROTECT || HARDENING_PATCH_HASH_PROTECT
5653+PHPAPI unsigned int php_canary();
5654+#endif
5655+
5656+#if HARDENING_PATCH_INC_PROTECT
5657+PHPAPI int php_is_valid_include(zval *z);
5658+#endif
5659+
5660+#endif /* HARDENING_PATCH_H */
5661+
5662+/*
5663+ * Local variables:
5664+ * tab-width: 4
5665+ * c-basic-offset: 4
5666+ * End:
5667+ */
5668diff -Nura php-4.4.2/main/hardening_patch.m4 hardening-patch-4.4.2-0.4.15/main/hardening_patch.m4
5669--- php-4.4.2/main/hardening_patch.m4 1970-01-01 01:00:00.000000000 +0100
5670+++ hardening-patch-4.4.2-0.4.15/main/hardening_patch.m4 2006-09-05 20:30:33.000000000 +0200
5671@@ -0,0 +1,95 @@
5672+dnl
5673+dnl $Id: hardening_patch.m4,v 1.1 2004/11/14 13:24:24 ionic Exp $
5674+dnl
5675+dnl This file contains Hardening Patch for PHP specific autoconf functions.
5676+dnl
5677+
5678+AC_ARG_ENABLE(hardening-patch-mm-protect,
5679+[ --disable-hardening-patch-mm-protect Disable the Memory Manager protection.],[
5680+ DO_HARDENING_PATCH_MM_PROTECT=$enableval
5681+],[
5682+ DO_HARDENING_PATCH_MM_PROTECT=yes
5683+])
5684+
5685+AC_ARG_ENABLE(hardening-patch-ll-protect,
5686+[ --disable-hardening-patch-ll-protect Disable the Linked List protection.],[
5687+ DO_HARDENING_PATCH_LL_PROTECT=$enableval
5688+],[
5689+ DO_HARDENING_PATCH_LL_PROTECT=yes
5690+])
5691+
5692+AC_ARG_ENABLE(hardening-patch-inc-protect,
5693+[ --disable-hardening-patch-inc-protect Disable include/require protection.],[
5694+ DO_HARDENING_PATCH_INC_PROTECT=$enableval
5695+],[
5696+ DO_HARDENING_PATCH_INC_PROTECT=yes
5697+])
5698+
5699+AC_ARG_ENABLE(hardening-patch-fmt-protect,
5700+[ --disable-hardening-patch-fmt-protect Disable format string protection.],[
5701+ DO_HARDENING_PATCH_FMT_PROTECT=$enableval
5702+],[
5703+ DO_HARDENING_PATCH_FMT_PROTECT=yes
5704+])
5705+
5706+AC_ARG_ENABLE(hardening-patch-hash-protect,
5707+[ --disable-hardening-patch-hash-protect Disable HashTable destructor protection.],[
5708+ DO_HARDENING_PATCH_HASH_PROTECT=$enableval
5709+],[
5710+ DO_HARDENING_PATCH_HASH_PROTECT=yes
5711+])
5712+
5713+AC_MSG_CHECKING(whether to protect the Zend Memory Manager)
5714+AC_MSG_RESULT($DO_HARDENING_PATCH_MM_PROTECT)
5715+
5716+AC_MSG_CHECKING(whether to protect the Zend Linked Lists)
5717+AC_MSG_RESULT($DO_HARDENING_PATCH_LL_PROTECT)
5718+
5719+AC_MSG_CHECKING(whether to protect include/require statements)
5720+AC_MSG_RESULT($DO_HARDENING_PATCH_INC_PROTECT)
5721+
5722+AC_MSG_CHECKING(whether to protect PHP Format String functions)
5723+AC_MSG_RESULT($DO_HARDENING_PATCH_FMT_PROTECT)
5724+
5725+AC_MSG_CHECKING(whether to protect the destructor of Zend HashTables)
5726+AC_MSG_RESULT($DO_HARDENING_PATCH_HASH_PROTECT)
5727+
5728+
5729+AC_DEFINE(HARDENING_PATCH, 1, [Hardening Patch])
5730+
5731+
5732+if test "$DO_HARDENING_PATCH_MM_PROTECT" = "yes"; then
5733+dnl AC_DEFINE(HARDENING_PATCH, 1, [Hardening Patch])
5734+ AC_DEFINE(HARDENING_PATCH_MM_PROTECT, 1, [Memory Manager Protection])
5735+else
5736+ AC_DEFINE(HARDENING_PATCH_MM_PROTECT, 0, [Memory Manager Protection])
5737+fi
5738+
5739+if test "$DO_HARDENING_PATCH_LL_PROTECT" = "yes"; then
5740+dnl AC_DEFINE(HARDENING_PATCH, 1, [Hardening Patch])
5741+ AC_DEFINE(HARDENING_PATCH_LL_PROTECT, 1, [Linked List Protection])
5742+else
5743+ AC_DEFINE(HARDENING_PATCH_LL_PROTECT, 0, [Linked List Protection])
5744+fi
5745+
5746+if test "$DO_HARDENING_PATCH_INC_PROTECT" = "yes"; then
5747+dnl AC_DEFINE(HARDENING_PATCH, 1, [Hardening Patch])
5748+ AC_DEFINE(HARDENING_PATCH_INC_PROTECT, 1, [Include/Require Protection])
5749+else
5750+ AC_DEFINE(HARDENING_PATCH_INC_PROTECT, 0, [Include/Require Protection])
5751+fi
5752+
5753+if test "$DO_HARDENING_PATCH_FMT_PROTECT" = "yes"; then
5754+dnl AC_DEFINE(HARDENING_PATCH, 1, [Hardening Patch])
5755+ AC_DEFINE(HARDENING_PATCH_FMT_PROTECT, 1, [Fmt String Protection])
5756+else
5757+ AC_DEFINE(HARDENING_PATCH_FMT_PROTECT, 0, [Fmt String Protection])
5758+fi
5759+
5760+if test "$DO_HARDENING_PATCH_HASH_PROTECT" = "yes"; then
5761+dnl AC_DEFINE(HARDENING_PATCH, 1, [Hardening Patch])
5762+ AC_DEFINE(HARDENING_PATCH_HASH_PROTECT, 1, [HashTable DTOR Protection])
5763+else
5764+ AC_DEFINE(HARDENING_PATCH_HASH_PROTECT, 0, [HashTable DTOR Protection])
5765+fi
5766+
5767diff -Nura php-4.4.2/main/main.c hardening-patch-4.4.2-0.4.15/main/main.c
5768--- php-4.4.2/main/main.c 2006-01-01 14:46:59.000000000 +0100
5769+++ hardening-patch-4.4.2-0.4.15/main/main.c 2006-09-05 20:30:33.000000000 +0200
5770@@ -92,6 +92,10 @@
5771 PHPAPI int core_globals_id;
5772 #endif
5773
5774+#if HARDENING_PATCH
5775+#include "hardened_globals.h"
5776+#endif
5777+
5778 #define ERROR_BUF_LEN 1024
5779
5780 typedef struct {
5781@@ -142,17 +146,39 @@
5782 */
5783 static PHP_INI_MH(OnChangeMemoryLimit)
5784 {
5785+#if HARDENING_PATCH
5786+ long hard_memory_limit = 1<<30;
5787+
5788+ if (stage == ZEND_INI_STAGE_RUNTIME) {
5789+ if (HG(hard_memory_limit) == 0) {
5790+ HG(hard_memory_limit) = PG(memory_limit);
5791+ }
5792+ hard_memory_limit = HG(hard_memory_limit);
5793+ } else {
5794+ HG(hard_memory_limit) = 0;
5795+ }
5796+#endif
5797 if (new_value) {
5798 PG(memory_limit) = zend_atoi(new_value, new_value_length);
5799+#if HARDENING_PATCH
5800+ if (PG(memory_limit) > hard_memory_limit) {
5801+ PG(memory_limit) = hard_memory_limit;
5802+ php_security_log(S_MISC, "script tried to increase memory_limit above allowed value");
5803+ return FAILURE;
5804+ }
5805+#endif
5806 } else {
5807+#if HARDENING_PATCH
5808+ PG(memory_limit) = hard_memory_limit;
5809+#else
5810 PG(memory_limit) = 1<<30; /* effectively, no limit */
5811+#endif
5812 }
5813 return zend_set_memory_limit(PG(memory_limit));
5814 }
5815 /* }}} */
5816 #endif
5817
5818-
5819 /* {{{ php_disable_functions
5820 */
5821 static void php_disable_functions(TSRMLS_D)
5822@@ -1008,6 +1034,9 @@
5823
5824 zend_try {
5825 shutdown_memory_manager(CG(unclean_shutdown), 0 TSRMLS_CC);
5826+#if HARDENING_PATCH
5827+ hardened_clear_mm_canaries(TSRMLS_C);
5828+#endif
5829 } zend_end_try();
5830
5831 zend_try {
5832@@ -1098,6 +1127,10 @@
5833 tsrm_ls = ts_resource(0);
5834 #endif
5835
5836+#if HARDENING_PATCH
5837+ hardened_startup();
5838+#endif
5839+
5840 sapi_initialize_empty_request(TSRMLS_C);
5841 sapi_activate(TSRMLS_C);
5842
5843@@ -1110,6 +1143,12 @@
5844 php_output_startup();
5845 php_output_activate(TSRMLS_C);
5846
5847+#if HARDENING_PATCH_INC_PROTECT
5848+ zuf.is_valid_include = php_is_valid_include;
5849+#endif
5850+#if HARDENING_PATCH
5851+ zuf.security_log_function = php_security_log;
5852+#endif
5853 zuf.error_function = php_error_cb;
5854 zuf.printf_function = php_printf;
5855 zuf.write_function = php_body_write_wrapper;
5856@@ -1211,6 +1250,10 @@
5857 REGISTER_MAIN_STRINGL_CONSTANT("PHP_CONFIG_FILE_PATH", PHP_CONFIG_FILE_PATH, sizeof(PHP_CONFIG_FILE_PATH)-1, CONST_PERSISTENT | CONST_CS);
5858 REGISTER_MAIN_STRINGL_CONSTANT("PHP_CONFIG_FILE_SCAN_DIR", PHP_CONFIG_FILE_SCAN_DIR, sizeof(PHP_CONFIG_FILE_SCAN_DIR)-1, CONST_PERSISTENT | CONST_CS);
5859 REGISTER_MAIN_STRINGL_CONSTANT("PHP_SHLIB_SUFFIX", PHP_SHLIB_SUFFIX, sizeof(PHP_SHLIB_SUFFIX)-1, CONST_PERSISTENT | CONST_CS);
5860+#if HARDENING_PATCH
5861+ REGISTER_MAIN_LONG_CONSTANT("HARDENING_PATCH", 1, CONST_PERSISTENT | CONST_CS);
5862+ REGISTER_MAIN_STRINGL_CONSTANT("HARDENING_PATCH_VERSION", HARDENING_PATCH_VERSION, sizeof(HARDENING_PATCH_VERSION)-1, CONST_PERSISTENT | CONST_CS);
5863+#endif
5864 REGISTER_MAIN_STRINGL_CONSTANT("PHP_EOL", PHP_EOL, sizeof(PHP_EOL)-1, CONST_PERSISTENT | CONST_CS);
5865 REGISTER_MAIN_LONG_CONSTANT("PHP_INT_MAX", LONG_MAX, CONST_PERSISTENT | CONST_CS);
5866 REGISTER_MAIN_LONG_CONSTANT("PHP_INT_SIZE", sizeof(long), CONST_PERSISTENT | CONST_CS);
5867@@ -1318,7 +1361,7 @@
5868 */
5869 static inline void php_register_server_variables(TSRMLS_D)
5870 {
5871- zval *array_ptr=NULL;
5872+ zval *array_ptr=NULL, *vptr;
5873
5874 ALLOC_ZVAL(array_ptr);
5875 array_init(array_ptr);
5876diff -Nura php-4.4.2/main/php_config.h.in hardening-patch-4.4.2-0.4.15/main/php_config.h.in
5877--- php-4.4.2/main/php_config.h.in 2006-01-12 19:24:28.000000000 +0100
5878+++ hardening-patch-4.4.2-0.4.15/main/php_config.h.in 2006-09-05 20:30:33.000000000 +0200
5879@@ -865,6 +865,39 @@
5880 /* Enabling BIND8 compatibility for Panther */
5881 #undef BIND_8_COMPAT
5882
5883+/* Hardening-Patch */
5884+#undef HARDENING_PATCH
5885+
5886+/* Memory Manager Protection */
5887+#undef HARDENING_PATCH_MM_PROTECT
5888+
5889+/* Memory Manager Protection */
5890+#undef HARDENING_PATCH_MM_PROTECT
5891+
5892+/* Linked List Protection */
5893+#undef HARDENING_PATCH_LL_PROTECT
5894+
5895+/* Linked List Protection */
5896+#undef HARDENING_PATCH_LL_PROTECT
5897+
5898+/* Include/Require Protection */
5899+#undef HARDENING_PATCH_INC_PROTECT
5900+
5901+/* Include/Require Protection */
5902+#undef HARDENING_PATCH_INC_PROTECT
5903+
5904+/* Fmt String Protection */
5905+#undef HARDENING_PATCH_FMT_PROTECT
5906+
5907+/* Fmt String Protection */
5908+#undef HARDENING_PATCH_FMT_PROTECT
5909+
5910+/* HashTable DTOR Protection */
5911+#undef HARDENING_PATCH_HASH_PROTECT
5912+
5913+/* HashTable DTOR Protection */
5914+#undef HARDENING_PATCH_HASH_PROTECT
5915+
5916 /* Whether you have AOLserver */
5917 #undef HAVE_AOLSERVER
5918
5919@@ -1148,6 +1181,12 @@
5920 /* Define if you have the getaddrinfo function */
5921 #undef HAVE_GETADDRINFO
5922
5923+/* Whether realpath is broken */
5924+#undef PHP_BROKEN_REALPATH
5925+
5926+/* Whether realpath is broken */
5927+#undef PHP_BROKEN_REALPATH
5928+
5929 /* Whether system headers declare timezone */
5930 #undef HAVE_DECLARED_TIMEZONE
5931
5932diff -Nura php-4.4.2/main/php_content_types.c hardening-patch-4.4.2-0.4.15/main/php_content_types.c
5933--- php-4.4.2/main/php_content_types.c 2006-01-01 14:46:59.000000000 +0100
5934+++ hardening-patch-4.4.2-0.4.15/main/php_content_types.c 2006-09-05 20:30:33.000000000 +0200
5935@@ -77,6 +77,7 @@
5936 sapi_register_post_entries(php_post_entries);
5937 sapi_register_default_post_reader(php_default_post_reader);
5938 sapi_register_treat_data(php_default_treat_data);
5939+ sapi_register_input_filter(php_default_input_filter);
5940 return SUCCESS;
5941 }
5942 /* }}} */
5943diff -Nura php-4.4.2/main/php.h hardening-patch-4.4.2-0.4.15/main/php.h
5944--- php-4.4.2/main/php.h 2006-01-01 14:46:59.000000000 +0100
5945+++ hardening-patch-4.4.2-0.4.15/main/php.h 2006-09-05 20:30:33.000000000 +0200
5946@@ -35,11 +35,19 @@
5947 #include "zend_qsort.h"
5948 #include "php_compat.h"
5949
5950+
5951 #include "zend_API.h"
5952
5953 #undef sprintf
5954 #define sprintf php_sprintf
5955
5956+#if HARDENING_PATCH
5957+#if HAVE_REALPATH
5958+#undef realpath
5959+#define realpath php_realpath
5960+#endif
5961+#endif
5962+
5963 /* PHP's DEBUG value must match Zend's ZEND_DEBUG value */
5964 #undef PHP_DEBUG
5965 #define PHP_DEBUG ZEND_DEBUG
5966@@ -409,6 +417,10 @@
5967 #endif
5968 #endif /* !XtOffsetOf */
5969
5970+#if HARDENING_PATCH
5971+#include "hardening_patch.h"
5972+#endif
5973+
5974 #endif
5975
5976 /*
5977diff -Nura php-4.4.2/main/php_open_temporary_file.c hardening-patch-4.4.2-0.4.15/main/php_open_temporary_file.c
5978--- php-4.4.2/main/php_open_temporary_file.c 2006-01-01 14:46:59.000000000 +0100
5979+++ hardening-patch-4.4.2-0.4.15/main/php_open_temporary_file.c 2006-09-05 20:30:33.000000000 +0200
5980@@ -16,7 +16,7 @@
5981 +----------------------------------------------------------------------+
5982 */
5983
5984-/* $Id: php_open_temporary_file.c,v 1.18.2.10.2.2 2006/01/01 13:46:59 sniper Exp $ */
5985+/* $Id: php_open_temporary_file.c,v 1.18.2.10.2.3 2006/05/23 23:23:39 iliaa Exp $ */
5986
5987 #include "php.h"
5988
5989@@ -115,17 +115,16 @@
5990
5991 path_len = strlen(path);
5992
5993- if (!(opened_path = emalloc(MAXPATHLEN))) {
5994- return -1;
5995- }
5996-
5997 if (!path_len || IS_SLASH(path[path_len - 1])) {
5998 trailing_slash = "";
5999 } else {
6000 trailing_slash = "/";
6001 }
6002
6003- (void)snprintf(opened_path, MAXPATHLEN, "%s%s%sXXXXXX", path, trailing_slash, pfx);
6004+ if (spprintf(&opened_path, 0, "%s%s%sXXXXXX", path, trailing_slash, pfx) >= MAXPATHLEN) {
6005+ efree(opened_path);
6006+ return -1;
6007+ }
6008
6009 #ifdef PHP_WIN32
6010 if (GetTempFileName(path, pfx, 0, opened_path)) {
6011diff -Nura php-4.4.2/main/php_variables.c hardening-patch-4.4.2-0.4.15/main/php_variables.c
6012--- php-4.4.2/main/php_variables.c 2006-01-01 14:47:00.000000000 +0100
6013+++ hardening-patch-4.4.2-0.4.15/main/php_variables.c 2006-09-05 20:30:33.000000000 +0200
6014@@ -236,17 +236,28 @@
6015 while (var) {
6016 val = strchr(var, '=');
6017 if (val) { /* have a value */
6018- int val_len;
6019+ unsigned int val_len, new_val_len;
6020
6021 *val++ = '\0';
6022 php_url_decode(var, strlen(var));
6023 val_len = php_url_decode(val, strlen(val));
6024- php_register_variable_safe(var, val, val_len, array_ptr TSRMLS_CC);
6025+ val = estrndup(val, val_len);
6026+ if (sapi_module.input_filter(PARSE_POST, var, &val, val_len, &new_val_len TSRMLS_CC)) {
6027+ php_register_variable_safe(var, val, new_val_len, array_ptr TSRMLS_CC);
6028+ }
6029+ efree(val);
6030 }
6031 var = php_strtok_r(NULL, "&", &strtok_buf);
6032 }
6033 }
6034
6035+SAPI_API SAPI_INPUT_FILTER_FUNC(php_default_input_filter)
6036+{
6037+ /* TODO: check .ini setting here and apply user-defined input filter */
6038+ *new_val_len = val_len;
6039+ return 1;
6040+}
6041+
6042 SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
6043 {
6044 char *res = NULL, *var, *val, *separator=NULL;
6045@@ -324,15 +335,26 @@
6046 while (var) {
6047 val = strchr(var, '=');
6048 if (val) { /* have a value */
6049- int val_len;
6050+ unsigned int val_len, new_val_len;
6051
6052 *val++ = '\0';
6053 php_url_decode(var, strlen(var));
6054 val_len = php_url_decode(val, strlen(val));
6055- php_register_variable_safe(var, val, val_len, array_ptr TSRMLS_CC);
6056+ val = estrndup(val, val_len);
6057+ if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
6058+ php_register_variable_safe(var, val, new_val_len, array_ptr TSRMLS_CC);
6059+ }
6060+ efree(val);
6061 } else {
6062+ unsigned int val_len, new_val_len;
6063+
6064 php_url_decode(var, strlen(var));
6065- php_register_variable_safe(var, "", 0, array_ptr TSRMLS_CC);
6066+ val_len = 0;
6067+ val = estrndup("", 0);
6068+ if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
6069+ php_register_variable_safe(var, val, new_val_len, array_ptr TSRMLS_CC);
6070+ }
6071+ efree(val);
6072 }
6073 var = php_strtok_r(NULL, separator, &strtok_buf);
6074 }
6075diff -Nura php-4.4.2/main/rfc1867.c hardening-patch-4.4.2-0.4.15/main/rfc1867.c
6076--- php-4.4.2/main/rfc1867.c 2006-01-01 14:47:00.000000000 +0100
6077+++ hardening-patch-4.4.2-0.4.15/main/rfc1867.c 2006-09-05 20:30:33.000000000 +0200
6078@@ -128,6 +128,8 @@
6079 #define UPLOAD_ERROR_D 4 /* No file uploaded */
6080 #define UPLOAD_ERROR_E 6 /* Missing /tmp or similar directory */
6081 #define UPLOAD_ERROR_F 7 /* Failed to write file to disk */
6082+#define UPLOAD_ERROR_X 99 /* Filter forbids upload */
6083+
6084
6085 void php_rfc1867_register_constants(TSRMLS_D)
6086 {
6087@@ -138,6 +140,7 @@
6088 REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_NO_FILE", UPLOAD_ERROR_D, CONST_CS | CONST_PERSISTENT);
6089 REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_NO_TMP_DIR", UPLOAD_ERROR_E, CONST_CS | CONST_PERSISTENT);
6090 REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_CANT_WRITE", UPLOAD_ERROR_F, CONST_CS | CONST_PERSISTENT);
6091+ REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_FILTER", UPLOAD_ERROR_X, CONST_CS | CONST_PERSISTENT);
6092 }
6093
6094 static void normalize_protected_variable(char *varname TSRMLS_DC)
6095@@ -849,6 +852,7 @@
6096 char buff[FILLUNIT];
6097 char *cd=NULL,*param=NULL,*filename=NULL, *tmp=NULL;
6098 int blen=0, wlen=0;
6099+ unsigned long offset;
6100
6101 zend_llist_clean(&header);
6102
6103@@ -897,21 +901,24 @@
6104 if (!filename && param) {
6105
6106 char *value = multipart_buffer_read_body(mbuff TSRMLS_CC);
6107+ unsigned int new_val_len; /* Dummy variable */
6108
6109 if (!value) {
6110 value = estrdup("");
6111 }
6112
6113+ if (sapi_module.input_filter(PARSE_POST, param, &value, strlen(value), &new_val_len TSRMLS_CC)) {
6114 #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
6115- if (php_mb_encoding_translation(TSRMLS_C)) {
6116- php_mb_gpc_stack_variable(param, value, &val_list, &len_list,
6117- &num_vars, &num_vars_max TSRMLS_CC);
6118- } else {
6119- safe_php_register_variable(param, value, array_ptr, 0 TSRMLS_CC);
6120- }
6121+ if (php_mb_encoding_translation(TSRMLS_C)) {
6122+ php_mb_gpc_stack_variable(param, value, &val_list, &len_list,
6123+ &num_vars, &num_vars_max TSRMLS_CC);
6124+ } else {
6125+ safe_php_register_variable(param, value, array_ptr, 0 TSRMLS_CC);
6126+ }
6127 #else
6128- safe_php_register_variable(param, value, array_ptr, 0 TSRMLS_CC);
6129+ safe_php_register_variable(param, value, array_ptr, 0 TSRMLS_CC);
6130 #endif
6131+ }
6132 if (!strcasecmp(param, "MAX_FILE_SIZE")) {
6133 max_file_size = atol(value);
6134 }
6135@@ -963,7 +970,11 @@
6136 tmp++;
6137 }
6138 }
6139-
6140+
6141+ if (sapi_module.upload_varname_filter && sapi_module.upload_varname_filter(param TSRMLS_CC)==FAILURE) {
6142+ skip_upload = 1;
6143+ }
6144+
6145 total_bytes = cancel_upload = 0;
6146
6147 if (!skip_upload) {
6148@@ -987,6 +998,11 @@
6149 cancel_upload = UPLOAD_ERROR_D;
6150 }
6151
6152+ if (sapi_module.pre_upload_filter && sapi_module.pre_upload_filter(param, filename TSRMLS_CC)==FAILURE) {
6153+ cancel_upload = UPLOAD_ERROR_X;
6154+ }
6155+
6156+ offset = 0;
6157 end = 0;
6158 while (!cancel_upload && (blen = multipart_buffer_read(mbuff, buff, sizeof(buff), &end TSRMLS_CC)))
6159 {
6160@@ -997,6 +1013,11 @@
6161 sapi_module.sapi_error(E_WARNING, "MAX_FILE_SIZE of %ld bytes exceeded - file [%s=%s] not saved", max_file_size, param, filename);
6162 cancel_upload = UPLOAD_ERROR_B;
6163 } else if (blen > 0) {
6164+
6165+ if (sapi_module.upload_content_filter && sapi_module.upload_content_filter(offset, buff, blen, &blen TSRMLS_CC)==FAILURE) {
6166+ cancel_upload = UPLOAD_ERROR_X;
6167+ }
6168+
6169 wlen = write(fd, buff, blen);
6170
6171 if (wlen < blen) {
6172@@ -1004,6 +1025,7 @@
6173 cancel_upload = UPLOAD_ERROR_F;
6174 } else {
6175 total_bytes += wlen;
6176+ offset += wlen;
6177 }
6178 }
6179 }
6180@@ -1025,6 +1047,10 @@
6181 }
6182 #endif
6183
6184+ if (!cancel_upload && sapi_module.post_upload_filter && sapi_module.post_upload_filter(temp_filename TSRMLS_CC)==FAILURE) {
6185+ cancel_upload = UPLOAD_ERROR_X;
6186+ }
6187+
6188 if (cancel_upload) {
6189 if (temp_filename) {
6190 if (cancel_upload != UPLOAD_ERROR_E) { /* file creation failed */
6191diff -Nura php-4.4.2/main/SAPI.c hardening-patch-4.4.2-0.4.15/main/SAPI.c
6192--- php-4.4.2/main/SAPI.c 2006-01-01 14:46:59.000000000 +0100
6193+++ hardening-patch-4.4.2-0.4.15/main/SAPI.c 2006-09-05 20:30:33.000000000 +0200
6194@@ -854,6 +854,37 @@
6195 return SUCCESS;
6196 }
6197
6198+SAPI_API int sapi_register_input_filter(unsigned int (*input_filter)(int arg, char *var, char **val, unsigned int val_len, unsigned int *new_val_len TSRMLS_DC))
6199+{
6200+ sapi_module.input_filter = input_filter;
6201+ return SUCCESS;
6202+}
6203+
6204+SAPI_API int sapi_register_upload_varname_filter(unsigned int (*upload_varname_filter)(char *varname TSRMLS_DC))
6205+{
6206+ sapi_module.upload_varname_filter = upload_varname_filter;
6207+ return SUCCESS;
6208+}
6209+
6210+SAPI_API int sapi_register_pre_upload_filter(unsigned int (*pre_upload_filter)(char *varname, char *filename TSRMLS_DC))
6211+{
6212+ sapi_module.pre_upload_filter = pre_upload_filter;
6213+ return SUCCESS;
6214+}
6215+
6216+SAPI_API int sapi_register_upload_content_filter(unsigned int (*upload_content_filter)(unsigned long offset, char *buffer, unsigned int buffer_len, unsigned int *new_buffer_len TSRMLS_DC))
6217+{
6218+ sapi_module.upload_content_filter = upload_content_filter;
6219+ return SUCCESS;
6220+}
6221+
6222+SAPI_API int sapi_register_post_upload_filter(unsigned int (*post_upload_filter)(char *tmpfilename TSRMLS_DC))
6223+{
6224+ sapi_module.post_upload_filter = post_upload_filter;
6225+ return SUCCESS;
6226+}
6227+
6228+
6229
6230 SAPI_API int sapi_flush(TSRMLS_D)
6231 {
6232diff -Nura php-4.4.2/main/SAPI.h hardening-patch-4.4.2-0.4.15/main/SAPI.h
6233--- php-4.4.2/main/SAPI.h 2006-01-01 14:46:59.000000000 +0100
6234+++ hardening-patch-4.4.2-0.4.15/main/SAPI.h 2006-09-05 20:30:33.000000000 +0200
6235@@ -101,9 +101,10 @@
6236 char *current_user;
6237 int current_user_length;
6238
6239- /* this is necessary for CLI module */
6240- int argc;
6241- char **argv;
6242+ /* this is necessary for CLI module */
6243+ int argc;
6244+ char **argv;
6245+
6246 } sapi_request_info;
6247
6248
6249@@ -177,6 +178,10 @@
6250 SAPI_API void sapi_unregister_post_entry(sapi_post_entry *post_entry);
6251 SAPI_API int sapi_register_default_post_reader(void (*default_post_reader)(TSRMLS_D));
6252 SAPI_API int sapi_register_treat_data(void (*treat_data)(int arg, char *str, zval *destArray TSRMLS_DC));
6253+SAPI_API int sapi_register_input_filter(unsigned int (*input_filter)(int arg, char *var, char **val, unsigned int val_len, unsigned int *new_val_len TSRMLS_DC));
6254+SAPI_API int sapi_register_pre_upload_filter(unsigned int (*pre_upload_filter)(char *varname, char *filename TSRMLS_DC));
6255+SAPI_API int sapi_register_upload_content_filter(unsigned int (*upload_content_filter)(unsigned long offset, char *buffer, unsigned int buffer_len, unsigned int *new_buffer_len TSRMLS_DC));
6256+SAPI_API int sapi_register_post_upload_filter(unsigned int (*post_upload_filter)(char *tmpfilename TSRMLS_DC));
6257
6258 SAPI_API int sapi_flush(TSRMLS_D);
6259 SAPI_API struct stat *sapi_get_stat(TSRMLS_D);
6260@@ -238,8 +243,16 @@
6261 int (*get_target_uid)(uid_t * TSRMLS_DC);
6262 int (*get_target_gid)(gid_t * TSRMLS_DC);
6263
6264+ unsigned int (*input_filter)(int arg, char *var, char **val, unsigned int val_len, unsigned int *new_val_len TSRMLS_DC);
6265+
6266+ unsigned int (*upload_varname_filter)(char *varname TSRMLS_DC);
6267+ unsigned int (*pre_upload_filter)(char *varname, char *filename TSRMLS_DC);
6268+ unsigned int (*upload_content_filter)(unsigned long offset, char *buffer, unsigned int buffer_len, unsigned int *new_buffer_len TSRMLS_DC);
6269+ unsigned int (*post_upload_filter)(char *tmpfilename TSRMLS_DC);
6270+
6271 void (*ini_defaults)(HashTable *configuration_hash);
6272 int phpinfo_as_text;
6273+
6274 };
6275
6276
6277@@ -262,16 +275,27 @@
6278
6279 #define SAPI_DEFAULT_MIMETYPE "text/html"
6280 #define SAPI_DEFAULT_CHARSET ""
6281+
6282+#if HARDENING_PATCH
6283+#define SAPI_PHP_VERSION_HEADER "X-Powered-By: PHP/" PHP_VERSION " with Hardening-Patch"
6284+#else
6285 #define SAPI_PHP_VERSION_HEADER "X-Powered-By: PHP/" PHP_VERSION
6286+#endif
6287
6288 #define SAPI_POST_READER_FUNC(post_reader) void post_reader(TSRMLS_D)
6289 #define SAPI_POST_HANDLER_FUNC(post_handler) void post_handler(char *content_type_dup, void *arg TSRMLS_DC)
6290
6291 #define SAPI_TREAT_DATA_FUNC(treat_data) void treat_data(int arg, char *str, zval* destArray TSRMLS_DC)
6292+#define SAPI_INPUT_FILTER_FUNC(input_filter) unsigned int input_filter(int arg, char *var, char **val, unsigned int val_len, unsigned int *new_val_len TSRMLS_DC)
6293+#define SAPI_UPLOAD_VARNAME_FILTER_FUNC(upload_varname_filter) unsigned int upload_varname_filter(char *varname TSRMLS_DC)
6294+#define SAPI_PRE_UPLOAD_FILTER_FUNC(pre_upload_filter) unsigned int pre_upload_filter(char *varname, char *filename TSRMLS_DC)
6295+#define SAPI_UPLOAD_CONTENT_FILTER_FUNC(upload_content_filter) unsigned int upload_content_filter(unsigned long offset, char *buffer, unsigned int buffer_len, unsigned int *new_buffer_len TSRMLS_DC)
6296+#define SAPI_POST_UPLOAD_FILTER_FUNC(post_upload_filter) unsigned int post_upload_filter(char *tmpfilename TSRMLS_DC)
6297
6298 SAPI_API SAPI_POST_READER_FUNC(sapi_read_standard_form_data);
6299 SAPI_API SAPI_POST_READER_FUNC(php_default_post_reader);
6300 SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data);
6301+SAPI_API SAPI_INPUT_FILTER_FUNC(php_default_input_filter);
6302
6303 #define STANDARD_SAPI_MODULE_PROPERTIES
6304
6305diff -Nura php-4.4.2/main/snprintf.c hardening-patch-4.4.2-0.4.15/main/snprintf.c
6306--- php-4.4.2/main/snprintf.c 2006-01-01 14:47:00.000000000 +0100
6307+++ hardening-patch-4.4.2-0.4.15/main/snprintf.c 2006-09-05 20:30:33.000000000 +0200
6308@@ -1014,7 +1014,11 @@
6309
6310
6311 case 'n':
6312+#if HARDENING_PATCH_FMT_PROTECT
6313+ php_security_log(S_MISC, "'n' specifier within format string");
6314+#else
6315 *(va_arg(ap, int *)) = cc;
6316+#endif
6317 break;
6318
6319 /*
6320diff -Nura php-4.4.2/main/spprintf.c hardening-patch-4.4.2-0.4.15/main/spprintf.c
6321--- php-4.4.2/main/spprintf.c 2006-01-01 14:47:00.000000000 +0100
6322+++ hardening-patch-4.4.2-0.4.15/main/spprintf.c 2006-09-05 20:30:33.000000000 +0200
6323@@ -630,7 +630,11 @@
6324
6325
6326 case 'n':
6327+#if HARDENING_PATCH_FMT_PROTECT
6328+ php_security_log(S_MISC, "'n' specifier within format string");
6329+#else
6330 *(va_arg(ap, int *)) = xbuf->len;
6331+#endif
6332 break;
6333
6334 /*
6335diff -Nura php-4.4.2/main/streams.c hardening-patch-4.4.2-0.4.15/main/streams.c
6336--- php-4.4.2/main/streams.c 2006-01-01 14:47:00.000000000 +0100
6337+++ hardening-patch-4.4.2-0.4.15/main/streams.c 2006-09-05 20:30:33.000000000 +0200
6338@@ -20,7 +20,7 @@
6339 +----------------------------------------------------------------------+
6340 */
6341
6342-/* $Id: streams.c,v 1.125.2.100.2.2 2006/01/01 13:47:00 sniper Exp $ */
6343+/* $Id: streams.c,v 1.125.2.100.2.3 2006/05/19 10:24:42 tony2001 Exp $ */
6344
6345 #define _GNU_SOURCE
6346 #include "php.h"
6347@@ -445,7 +445,7 @@
6348 * charsets (for example) but still be able to provide them all as filters */
6349 PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, const char *filterparams, int filterparamslen, int persistent TSRMLS_DC)
6350 {
6351- php_stream_filter_factory *factory;
6352+ php_stream_filter_factory *factory = NULL;
6353 php_stream_filter *filter = NULL;
6354 int n;
6355 char *period;
6356diff -Nura php-4.4.2/php.ini-dist hardening-patch-4.4.2-0.4.15/php.ini-dist
6357--- php-4.4.2/php.ini-dist 2005-12-30 18:19:43.000000000 +0100
6358+++ hardening-patch-4.4.2-0.4.15/php.ini-dist 2006-09-05 20:30:33.000000000 +0200
6359@@ -1114,6 +1114,209 @@
6360 ;exif.decode_jis_motorola = JIS
6361 ;exif.decode_jis_intel = JIS
6362
6363+[hardening-patch]
6364+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6365+; Hardening-Patch's logging ;
6366+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6367+
6368+;
6369+; hphp.log.syslog - Configures level for alerts reported through syslog
6370+; hphp.log.sapi - Configures level for alerts reported through SAPI errorlog
6371+; hphp.log.script - Configures level for alerts reported through external script
6372+;
6373+; hphp.log.syslog, hphp.log.sapi, hphp.log.script are bit-fields.
6374+; Or each number up to get desired Hardening-Patch's reporting level
6375+;
6376+; S_ALL - All alerts
6377+; S_MEMORY - All canary violations and the safe unlink protection use this class
6378+; S_VARS - All variable filters trigger this class
6379+; S_FILES - All violation of uploaded files filter use this class
6380+; S_INCLUDE - The protection against malicious include filenames use this class
6381+; S_SQL - Failed SQL queries in MySQL are logged with this class
6382+; S_EXECUTOR - The execution depth protection uses this logging class
6383+; S_MISC - All other log messages (f.e. format string protection) use this class
6384+;
6385+; Example:
6386+;
6387+; - Report all alerts (except memory alerts) to the SAPI errorlog,
6388+; memory alerts through syslog and SQL+Include alerts fo the script
6389+;
6390+;hphp.log.syslog = S_MEMORY
6391+;hphp.log.sapi = S_ALL & ~S_MEMORY
6392+;hphp.log.script = S_INCLUDE | S_SQL
6393+;
6394+; Syslog logging:
6395+;
6396+; - Facility configuration: one of the following facilities
6397+;
6398+; LOG_KERN, LOG_USER, LOG_MAIL, LOG_DAEMON
6399+; LOG_AUTH, LOG_SYSLOG, LOG_LPR, LOG_NEWS
6400+; LOG_UUCP, LOG_CRON, LOG_AUTHPRIV, LOG_LOCAL0
6401+; LOG_LOCAL1, LOG_LOCAL2, LOG_LOCAL3, LOG_LOCAL4
6402+; LOG_LOCAL5, LOG_LOCAL6, LOG_LOCAL7, LOG_PID
6403+; LOG_CONS, LOG_ODELAY, LOG_NDELAY, LOG_NOWAIT
6404+; LOG_PERROR
6405+;
6406+; - Priority configuration: one of the followinf priorities
6407+;
6408+; LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_WARNING
6409+; LOG_NOTICE, LOG_INFO, LOG_DEBUG, LOG_ERR
6410+;
6411+hphp.log.syslog.priority = LOG_ALERT
6412+hphp.log.syslog.facility = LOG_USER
6413+;
6414+; Script logging:
6415+;
6416+;hphp.log.script.name = /home/hphp/log_script
6417+;
6418+; Alert configuration:
6419+;
6420+; - Logged IP addresses from X-Forwarded-For instead of REMOTE_ADDR
6421+;
6422+;hphp.log.use-x-forwarded-for = On
6423+;
6424+
6425+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6426+; Hardening-Patch's Executor options ;
6427+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6428+
6429+; Execution depth limit
6430+;hphp.executor.max_depth = 8000
6431+
6432+; White-/blacklist for function calls during normal execution
6433+;hphp.executor.func.whitelist = ord,chr
6434+;hphp.executor.func.blacklist = system,shell_exec,popen,proc_open,exec,passthru
6435+
6436+; White-/blacklist for function calls during eval() execution
6437+;hphp.executor.eval.whitelist = ord,chr
6438+;hphp.executor.eval.blacklist = system,shell_exec,popen,proc_open,exec,passthru
6439+
6440+; White-/blacklist for URLs allowes in include filenames
6441+;
6442+; - When both options are not set all URLs are forbidden
6443+;
6444+; - When both options are set whitelist is taken and blacklist ignored
6445+;
6446+; - An entry in the lists is either a URL sheme like: http, https
6447+; or the beginning of an URL like: php://input
6448+;
6449+;hphp.executor.include.whitelist = cookietest
6450+;hphp.executor.include.blacklist = http, https, ftp, ftps, php://input, file
6451+
6452+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6453+; Hardening-Patch's REQUEST variable filters ;
6454+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6455+
6456+; Limits the number of REQUEST variables
6457+hphp.request.max_vars = 200
6458+
6459+; Limits the length of variable names (without indices)
6460+hphp.request.max_varname_length = 64
6461+
6462+; Limits the length of complete variable names (with indices)
6463+hphp.request.max_totalname_length = 256
6464+
6465+; Limits the length of array indices
6466+hphp.request.max_array_index_length = 64
6467+
6468+; Limits the depth of arrays
6469+hphp.request.max_array_depth = 100
6470+
6471+; Limits the length of variable values
6472+hphp.request.max_value_length = 65000
6473+
6474+; Disallow ASCII-NUL characters in input
6475+hphp.request.disallow_nul = 1
6476+
6477+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6478+; Hardening-Patch's COOKIE variable filters ;
6479+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6480+
6481+; Limits the number of COOKIE variables
6482+hphp.cookie.max_vars = 100
6483+
6484+; Limits the length of variable names (without indices)
6485+hphp.cookie.max_name_length = 64
6486+
6487+; Limits the length of complete variable names (with indices)
6488+hphp.cookie.max_totalname_length = 256
6489+
6490+; Limits the length of array indices
6491+hphp.cookie.max_array_index_length = 64
6492+
6493+; Limits the depth of arrays
6494+hphp.cookie.max_array_depth = 100
6495+
6496+; Limits the length of variable values
6497+hphp.cookie.max_value_length = 10000
6498+
6499+; Disallow ASCII-NUL characters in input
6500+hphp.cookie.disallow_nul = 1
6501+
6502+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6503+; Hardening-Patch's GET variable filters ;
6504+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6505+
6506+; Limits the number of COOKIE variables
6507+hphp.get.max_vars = 100
6508+
6509+; Limits the length of variable names (without indices)
6510+hphp.get.max_name_length = 64
6511+
6512+; Limits the length of complete variable names (with indices)
6513+hphp.get.max_totalname_length = 256
6514+
6515+; Limits the length of array indices
6516+hphp.get.max_array_index_length = 64
6517+
6518+; Limits the depth of arrays
6519+hphp.get.max_array_depth = 50
6520+
6521+; Limits the length of variable values
6522+hphp.get.max_value_length = 512
6523+
6524+; Disallow ASCII-NUL characters in input
6525+hphp.get.disallow_nul = 1
6526+
6527+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6528+; Hardening-Patch's POST variable filters ;
6529+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6530+
6531+; Limits the number of POST variables
6532+hphp.post.max_vars = 200
6533+
6534+; Limits the length of variable names (without indices)
6535+hphp.post.max_name_length = 64
6536+
6537+; Limits the length of complete variable names (with indices)
6538+hphp.post.max_totalname_length = 256
6539+
6540+; Limits the length of array indices
6541+hphp.post.max_array_index_length = 64
6542+
6543+; Limits the depth of arrays
6544+hphp.post.max_array_depth = 100
6545+
6546+; Limits the length of variable values
6547+hphp.post.max_value_length = 65000
6548+
6549+; Disallow ASCII-NUL characters in input
6550+hphp.post.disallow_nul = 1
6551+
6552+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6553+; Hardening-Patch's fileupload variable filters ;
6554+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6555+
6556+; Limits the number of uploadable files
6557+hphp.upload.max_uploads = 25
6558+
6559+; Filter out the upload of ELF executables
6560+hphp.upload.disallow_elf_files = On
6561+
6562+; External filterscript for upload verification
6563+;hphp.upload.verification_script = /home/hphp/verify_script
6564+
6565+
6566 ; Local Variables:
6567 ; tab-width: 4
6568 ; End:
6569diff -Nura php-4.4.2/php.ini-recommended hardening-patch-4.4.2-0.4.15/php.ini-recommended
6570--- php-4.4.2/php.ini-recommended 2005-12-30 18:19:43.000000000 +0100
6571+++ hardening-patch-4.4.2-0.4.15/php.ini-recommended 2006-09-05 20:30:33.000000000 +0200
6572@@ -1112,6 +1112,209 @@
6573 ;exif.decode_jis_motorola = JIS
6574 ;exif.decode_jis_intel = JIS
6575
6576+[hardening-patch]
6577+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6578+; Hardening-Patch's logging ;
6579+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6580+
6581+;
6582+; hphp.log.syslog - Configures level for alerts reported through syslog
6583+; hphp.log.sapi - Configures level for alerts reported through SAPI errorlog
6584+; hphp.log.script - Configures level for alerts reported through external script
6585+;
6586+; hphp.log.syslog, hphp.log.sapi, hphp.log.script are bit-fields.
6587+; Or each number up to get desired Hardening-Patch's reporting level
6588+;
6589+; S_ALL - All alerts
6590+; S_MEMORY - All canary violations and the safe unlink protection use this class
6591+; S_VARS - All variable filters trigger this class
6592+; S_FILES - All violation of uploaded files filter use this class
6593+; S_INCLUDE - The protection against malicious include filenames use this class
6594+; S_SQL - Failed SQL queries in MySQL are logged with this class
6595+; S_EXECUTOR - The execution depth protection uses this logging class
6596+; S_MISC - All other log messages (f.e. format string protection) use this class
6597+;
6598+; Example:
6599+;
6600+; - Report all alerts (except memory alerts) to the SAPI errorlog,
6601+; memory alerts through syslog and SQL+Include alerts fo the script
6602+;
6603+;hphp.log.syslog = S_MEMORY
6604+;hphp.log.sapi = S_ALL & ~S_MEMORY
6605+;hphp.log.script = S_INCLUDE | S_SQL
6606+;
6607+; Syslog logging:
6608+;
6609+; - Facility configuration: one of the following facilities
6610+;
6611+; LOG_KERN, LOG_USER, LOG_MAIL, LOG_DAEMON
6612+; LOG_AUTH, LOG_SYSLOG, LOG_LPR, LOG_NEWS
6613+; LOG_UUCP, LOG_CRON, LOG_AUTHPRIV, LOG_LOCAL0
6614+; LOG_LOCAL1, LOG_LOCAL2, LOG_LOCAL3, LOG_LOCAL4
6615+; LOG_LOCAL5, LOG_LOCAL6, LOG_LOCAL7, LOG_PID
6616+; LOG_CONS, LOG_ODELAY, LOG_NDELAY, LOG_NOWAIT
6617+; LOG_PERROR
6618+;
6619+; - Priority configuration: one of the followinf priorities
6620+;
6621+; LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_WARNING
6622+; LOG_NOTICE, LOG_INFO, LOG_DEBUG, LOG_ERR
6623+;
6624+hphp.log.syslog.priority = LOG_ALERT
6625+hphp.log.syslog.facility = LOG_USER
6626+;
6627+; Script logging:
6628+;
6629+;hphp.log.script.name = /home/hphp/log_script
6630+;
6631+; Alert configuration:
6632+;
6633+; - Logged IP addresses from X-Forwarded-For instead of REMOTE_ADDR
6634+;
6635+;hphp.log.use-x-forwarded-for = On
6636+;
6637+
6638+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6639+; Hardening-Patch's Executor options ;
6640+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6641+
6642+; Execution depth limit
6643+;hphp.executor.max_depth = 8000
6644+
6645+; White-/blacklist for function calls during normal execution
6646+;hphp.executor.func.whitelist = ord,chr
6647+;hphp.executor.func.blacklist = system,shell_exec,popen,proc_open,exec,passthru
6648+
6649+; White-/blacklist for function calls during eval() execution
6650+;hphp.executor.eval.whitelist = ord,chr
6651+;hphp.executor.eval.blacklist = system,shell_exec,popen,proc_open,exec,passthru
6652+
6653+; White-/blacklist for URLs allowes in include filenames
6654+;
6655+; - When both options are not set all URLs are forbidden
6656+;
6657+; - When both options are set whitelist is taken and blacklist ignored
6658+;
6659+; - An entry in the lists is either a URL sheme like: http, https
6660+; or the beginning of an URL like: php://input
6661+;
6662+;hphp.executor.include.whitelist = cookietest
6663+;hphp.executor.include.blacklist = http, https, ftp, ftps, php://input, file
6664+
6665+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6666+; Hardening-Patch's REQUEST variable filters ;
6667+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6668+
6669+; Limits the number of REQUEST variables
6670+hphp.request.max_vars = 200
6671+
6672+; Limits the length of variable names (without indices)
6673+hphp.request.max_varname_length = 64
6674+
6675+; Limits the length of complete variable names (with indices)
6676+hphp.request.max_totalname_length = 256
6677+
6678+; Limits the length of array indices
6679+hphp.request.max_array_index_length = 64
6680+
6681+; Limits the depth of arrays
6682+hphp.request.max_array_depth = 100
6683+
6684+; Limits the length of variable values
6685+hphp.request.max_value_length = 65000
6686+
6687+; Disallow ASCII-NUL characters in input
6688+hphp.request.disallow_nul = 1
6689+
6690+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6691+; Hardening-Patch's COOKIE variable filters ;
6692+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6693+
6694+; Limits the number of COOKIE variables
6695+hphp.cookie.max_vars = 100
6696+
6697+; Limits the length of variable names (without indices)
6698+hphp.cookie.max_name_length = 64
6699+
6700+; Limits the length of complete variable names (with indices)
6701+hphp.cookie.max_totalname_length = 256
6702+
6703+; Limits the length of array indices
6704+hphp.cookie.max_array_index_length = 64
6705+
6706+; Limits the depth of arrays
6707+hphp.cookie.max_array_depth = 100
6708+
6709+; Limits the length of variable values
6710+hphp.cookie.max_value_length = 10000
6711+
6712+; Disallow ASCII-NUL characters in input
6713+hphp.cookie.disallow_nul = 1
6714+
6715+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6716+; Hardening-Patch's GET variable filters ;
6717+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6718+
6719+; Limits the number of COOKIE variables
6720+hphp.get.max_vars = 100
6721+
6722+; Limits the length of variable names (without indices)
6723+hphp.get.max_name_length = 64
6724+
6725+; Limits the length of complete variable names (with indices)
6726+hphp.get.max_totalname_length = 256
6727+
6728+; Limits the length of array indices
6729+hphp.get.max_array_index_length = 64
6730+
6731+; Limits the depth of arrays
6732+hphp.get.max_array_depth = 50
6733+
6734+; Limits the length of variable values
6735+hphp.get.max_value_length = 512
6736+
6737+; Disallow ASCII-NUL characters in input
6738+hphp.get.disallow_nul = 1
6739+
6740+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6741+; Hardening-Patch's POST variable filters ;
6742+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6743+
6744+; Limits the number of POST variables
6745+hphp.post.max_vars = 200
6746+
6747+; Limits the length of variable names (without indices)
6748+hphp.post.max_name_length = 64
6749+
6750+; Limits the length of complete variable names (with indices)
6751+hphp.post.max_totalname_length = 256
6752+
6753+; Limits the length of array indices
6754+hphp.post.max_array_index_length = 64
6755+
6756+; Limits the depth of arrays
6757+hphp.post.max_array_depth = 100
6758+
6759+; Limits the length of variable values
6760+hphp.post.max_value_length = 65000
6761+
6762+; Disallow ASCII-NUL characters in input
6763+hphp.post.disallow_nul = 1
6764+
6765+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6766+; Hardening-Patch's fileupload variable filters ;
6767+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6768+
6769+; Limits the number of uploadable files
6770+hphp.upload.max_uploads = 25
6771+
6772+; Filter out the upload of ELF executables
6773+hphp.upload.disallow_elf_files = On
6774+
6775+; External filterscript for upload verification
6776+;hphp.upload.verification_script = /home/hphp/verify_script
6777+
6778+
6779 ; Local Variables:
6780 ; tab-width: 4
6781 ; End:
6782diff -Nura php-4.4.2/README.input_filter hardening-patch-4.4.2-0.4.15/README.input_filter
6783--- php-4.4.2/README.input_filter 1970-01-01 01:00:00.000000000 +0100
6784+++ hardening-patch-4.4.2-0.4.15/README.input_filter 2006-09-05 20:30:33.000000000 +0200
6785@@ -0,0 +1,193 @@
6786+Input Filter Support ported from PHP 5
6787+--------------------------------------
6788+
6789+XSS (Cross Site Scripting) hacks are becoming more and more prevalent,
6790+and can be quite difficult to prevent. Whenever you accept user data
6791+and somehow display this data back to users, you are likely vulnerable
6792+to XSS hacks.
6793+
6794+The Input Filter support in PHP 5 is aimed at providing the framework
6795+through which a company-wide or site-wide security policy can be
6796+enforced. It is implemented as a SAPI hook and is called from the
6797+treat_data and post handler functions. To implement your own security
6798+policy you will need to write a standard PHP extension.
6799+
6800+A simple implementation might look like the following. This stores the
6801+original raw user data and adds a my_get_raw() function while the normal
6802+$_POST, $_GET and $_COOKIE arrays are only populated with stripped
6803+data. In this simple example all I am doing is calling strip_tags() on
6804+the data. If register_globals is turned on, the default globals that
6805+are created will be stripped ($foo) while a $RAW_foo is created with the
6806+original user input.
6807+
6808+ZEND_BEGIN_MODULE_GLOBALS(my_input_filter)
6809+ zval *post_array;
6810+ zval *get_array;
6811+ zval *cookie_array;
6812+ZEND_END_MODULE_GLOBALS(my_input_filter)
6813+
6814+#ifdef ZTS
6815+#define IF_G(v) TSRMG(my_input_filter_globals_id, zend_my_input_filter_globals *, v)
6816+#else
6817+#define IF_G(v) (my_input_filter_globals.v)
6818+#endif
6819+
6820+ZEND_DECLARE_MODULE_GLOBALS(my_input_filter)
6821+
6822+function_entry my_input_filter_functions[] = {
6823+ PHP_FE(my_get_raw, NULL)
6824+ {NULL, NULL, NULL}
6825+};
6826+
6827+zend_module_entry my_input_filter_module_entry = {
6828+ STANDARD_MODULE_HEADER,
6829+ "my_input_filter",
6830+ my_input_filter_functions,
6831+ PHP_MINIT(my_input_filter),
6832+ PHP_MSHUTDOWN(my_input_filter),
6833+ NULL,
6834+ PHP_RSHUTDOWN(my_input_filter),
6835+ PHP_MINFO(my_input_filter),
6836+ "0.1",
6837+ STANDARD_MODULE_PROPERTIES
6838+};
6839+
6840+PHP_MINIT_FUNCTION(my_input_filter)
6841+{
6842+ ZEND_INIT_MODULE_GLOBALS(my_input_filter, php_my_input_filter_init_globals, NULL);
6843+
6844+ REGISTER_LONG_CONSTANT("POST", PARSE_POST, CONST_CS | CONST_PERSISTENT);
6845+ REGISTER_LONG_CONSTANT("GET", PARSE_GET, CONST_CS | CONST_PERSISTENT);
6846+ REGISTER_LONG_CONSTANT("COOKIE", PARSE_COOKIE, CONST_CS | CONST_PERSISTENT);
6847+
6848+ sapi_register_input_filter(my_sapi_input_filter);
6849+ return SUCCESS;
6850+}
6851+
6852+PHP_RSHUTDOWN_FUNCTION(my_input_filter)
6853+{
6854+ if(IF_G(get_array)) {
6855+ zval_ptr_dtor(&IF_G(get_array));
6856+ IF_G(get_array) = NULL;
6857+ }
6858+ if(IF_G(post_array)) {
6859+ zval_ptr_dtor(&IF_G(post_array));
6860+ IF_G(post_array) = NULL;
6861+ }
6862+ if(IF_G(cookie_array)) {
6863+ zval_ptr_dtor(&IF_G(cookie_array));
6864+ IF_G(cookie_array) = NULL;
6865+ }
6866+ return SUCCESS;
6867+}
6868+
6869+PHP_MINFO_FUNCTION(my_input_filter)
6870+{
6871+ php_info_print_table_start();
6872+ php_info_print_table_row( 2, "My Input Filter Support", "enabled" );
6873+ php_info_print_table_row( 2, "Revision", "$Revision: 1.1 $");
6874+ php_info_print_table_end();
6875+}
6876+
6877+/* The filter handler. If you return 1 from it, then PHP also registers the
6878+ * (modified) variable. Returning 0 prevents PHP from registering the variable;
6879+ * you can use this if your filter already registers the variable under a
6880+ * different name, or if you just don't want the variable registered at all. */
6881+SAPI_INPUT_FILTER_FUNC(my_sapi_input_filter)
6882+{
6883+ zval new_var;
6884+ zval *array_ptr = NULL;
6885+ char *raw_var;
6886+ int var_len;
6887+
6888+ assert(*val != NULL);
6889+
6890+ switch(arg) {
6891+ case PARSE_GET:
6892+ if(!IF_G(get_array)) {
6893+ ALLOC_ZVAL(array_ptr);
6894+ array_init(array_ptr);
6895+ INIT_PZVAL(array_ptr);
6896+ }
6897+ IF_G(get_array) = array_ptr;
6898+ break;
6899+ case PARSE_POST:
6900+ if(!IF_G(post_array)) {
6901+ ALLOC_ZVAL(array_ptr);
6902+ array_init(array_ptr);
6903+ INIT_PZVAL(array_ptr);
6904+ }
6905+ IF_G(post_array) = array_ptr;
6906+ break;
6907+ case PARSE_COOKIE:
6908+ if(!IF_G(cookie_array)) {
6909+ ALLOC_ZVAL(array_ptr);
6910+ array_init(array_ptr);
6911+ INIT_PZVAL(array_ptr);
6912+ }
6913+ IF_G(cookie_array) = array_ptr;
6914+ break;
6915+ }
6916+ Z_STRLEN(new_var) = val_len;
6917+ Z_STRVAL(new_var) = estrndup(*val, val_len);
6918+ Z_TYPE(new_var) = IS_STRING;
6919+
6920+ var_len = strlen(var);
6921+ raw_var = emalloc(var_len+5); /* RAW_ and a \0 */
6922+ strcpy(raw_var, "RAW_");
6923+ strlcat(raw_var,var,var_len+5);
6924+
6925+ php_register_variable_ex(raw_var, &new_var, array_ptr TSRMLS_DC);
6926+
6927+ php_strip_tags(*val, val_len, NULL, NULL, 0);
6928+
6929+ *new_val_len = strlen(*val);
6930+ return 1;
6931+}
6932+
6933+PHP_FUNCTION(my_get_raw)
6934+{
6935+ long arg;
6936+ char *var;
6937+ int var_len;
6938+ zval **tmp;
6939+ zval *array_ptr = NULL;
6940+ HashTable *hash_ptr;
6941+ char *raw_var;
6942+
6943+ if(zend_parse_parameters(2 TSRMLS_CC, "ls", &arg, &var, &var_len) == FAILURE) {
6944+ return;
6945+ }
6946+
6947+ switch(arg) {
6948+ case PARSE_GET:
6949+ array_ptr = IF_G(get_array);
6950+ break;
6951+ case PARSE_POST:
6952+ array_ptr = IF_G(post_array);
6953+ break;
6954+ case PARSE_COOKIE:
6955+ array_ptr = IF_G(post_array);
6956+ break;
6957+ }
6958+
6959+ if(!array_ptr) RETURN_FALSE;
6960+
6961+ /*
6962+ * I'm changing the variable name here because when running with register_globals on,
6963+ * the variable will end up in the global symbol table
6964+ */
6965+ raw_var = emalloc(var_len+5); /* RAW_ and a \0 */
6966+ strcpy(raw_var, "RAW_");
6967+ strlcat(raw_var,var,var_len+5);
6968+ hash_ptr = HASH_OF(array_ptr);
6969+
6970+ if(zend_hash_find(hash_ptr, raw_var, var_len+5, (void **)&tmp) == SUCCESS) {
6971+ *return_value = **tmp;
6972+ zval_copy_ctor(return_value);
6973+ } else {
6974+ RETVAL_FALSE;
6975+ }
6976+ efree(raw_var);
6977+}
6978+
6979diff -Nura php-4.4.2/run-tests.php hardening-patch-4.4.2-0.4.15/run-tests.php
6980--- php-4.4.2/run-tests.php 2006-01-01 14:46:48.000000000 +0100
6981+++ hardening-patch-4.4.2-0.4.15/run-tests.php 2006-09-05 20:30:33.000000000 +0200
6982@@ -152,6 +152,10 @@
6983 'error_reporting=2047',
6984 'display_errors=1',
6985 'log_errors=0',
6986+ 'hphp.executor.include.whitelist=cookietest',
6987+ 'hphp.log.syslog=0',
6988+ 'hphp.log.sapi=0',
6989+ 'hphp.log.script=0',
6990 'html_errors=0',
6991 'track_errors=1',
6992 'report_memleaks=1',
6993diff -Nura php-4.4.2/sapi/apache/mod_php4.c hardening-patch-4.4.2-0.4.15/sapi/apache/mod_php4.c
6994--- php-4.4.2/sapi/apache/mod_php4.c 2006-01-01 14:47:01.000000000 +0100
6995+++ hardening-patch-4.4.2-0.4.15/sapi/apache/mod_php4.c 2006-09-05 20:30:33.000000000 +0200
6996@@ -452,7 +452,7 @@
6997 sapi_apache_get_fd,
6998 sapi_apache_force_http_10,
6999 sapi_apache_get_target_uid,
7000- sapi_apache_get_target_gid
7001+ sapi_apache_get_target_gid,
7002 };
7003 /* }}} */
7004
7005@@ -898,7 +898,11 @@
7006 {
7007 TSRMLS_FETCH();
7008 if (PG(expose_php)) {
7009+#if HARDENING_PATCH
7010+ ap_add_version_component("PHP/" PHP_VERSION " with Hardening-Patch");
7011+#else
7012 ap_add_version_component("PHP/" PHP_VERSION);
7013+#endif
7014 }
7015 }
7016 #endif
7017diff -Nura php-4.4.2/sapi/apache2filter/sapi_apache2.c hardening-patch-4.4.2-0.4.15/sapi/apache2filter/sapi_apache2.c
7018--- php-4.4.2/sapi/apache2filter/sapi_apache2.c 2006-01-01 14:47:01.000000000 +0100
7019+++ hardening-patch-4.4.2-0.4.15/sapi/apache2filter/sapi_apache2.c 2006-09-05 20:30:33.000000000 +0200
7020@@ -562,7 +562,11 @@
7021 {
7022 TSRMLS_FETCH();
7023 if (PG(expose_php)) {
7024+#if HARDENING_PATCH
7025+ ap_add_version_component(p, "PHP/" PHP_VERSION " with Hardening-Patch");
7026+#else
7027 ap_add_version_component(p, "PHP/" PHP_VERSION);
7028+#endif
7029 }
7030 }
7031
7032diff -Nura php-4.4.2/sapi/apache2handler/sapi_apache2.c hardening-patch-4.4.2-0.4.15/sapi/apache2handler/sapi_apache2.c
7033--- php-4.4.2/sapi/apache2handler/sapi_apache2.c 2006-01-01 14:47:01.000000000 +0100
7034+++ hardening-patch-4.4.2-0.4.15/sapi/apache2handler/sapi_apache2.c 2006-09-05 20:30:33.000000000 +0200
7035@@ -340,7 +340,11 @@
7036 {
7037 TSRMLS_FETCH();
7038 if (PG(expose_php)) {
7039+#if HARDENING_PATCH
7040+ ap_add_version_component(p, "PHP/" PHP_VERSION " with Hardening-Patch");
7041+#else
7042 ap_add_version_component(p, "PHP/" PHP_VERSION);
7043+#endif
7044 }
7045 }
7046
7047diff -Nura php-4.4.2/sapi/cgi/cgi_main.c hardening-patch-4.4.2-0.4.15/sapi/cgi/cgi_main.c
7048--- php-4.4.2/sapi/cgi/cgi_main.c 2006-01-01 14:47:01.000000000 +0100
7049+++ hardening-patch-4.4.2-0.4.15/sapi/cgi/cgi_main.c 2006-09-05 20:30:33.000000000 +0200
7050@@ -1432,11 +1432,19 @@
7051 SG(headers_sent) = 1;
7052 SG(request_info).no_headers = 1;
7053 }
7054+#if HARDENING_PATCH
7055+#if ZEND_DEBUG
7056+ php_printf("PHP %s with Hardening-Patch %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2004 The PHP Group\n%s", PHP_VERSION, HARDENING_PATCH_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
7057+#else
7058+ php_printf("PHP %s with Hardening-Patch %s (%s) (built: %s %s)\nCopyright (c) 1997-2004 The PHP Group\n%s", PHP_VERSION, HARDENING_PATCH_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
7059+#endif
7060+#else
7061 #if ZEND_DEBUG
7062 php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2006 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
7063 #else
7064 php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2006 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
7065 #endif
7066+#endif
7067 php_end_ob_buffers(1 TSRMLS_CC);
7068 exit(0);
7069 break;
7070diff -Nura php-4.4.2/sapi/cli/php_cli.c hardening-patch-4.4.2-0.4.15/sapi/cli/php_cli.c
7071--- php-4.4.2/sapi/cli/php_cli.c 2006-01-01 14:47:01.000000000 +0100
7072+++ hardening-patch-4.4.2-0.4.15/sapi/cli/php_cli.c 2006-09-05 20:30:33.000000000 +0200
7073@@ -654,11 +654,19 @@
7074 if (php_request_startup(TSRMLS_C)==FAILURE) {
7075 goto err;
7076 }
7077+#if HARDENING_PATCH
7078+#if ZEND_DEBUG
7079+ php_printf("PHP %s with Hardening-Patch %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2004 The PHP Group\n%s", PHP_VERSION, HARDENING_PATCH_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
7080+#else
7081+ php_printf("PHP %s with Hardening-Patch %s (%s) (built: %s %s)\nCopyright (c) 1997-2004 The PHP Group\n%s", PHP_VERSION, HARDENING_PATCH_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
7082+#endif
7083+#else
7084 #if ZEND_DEBUG
7085 php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2006 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
7086 #else
7087 php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2006 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
7088 #endif
7089+#endif
7090 php_end_ob_buffers(1 TSRMLS_CC);
7091 exit_status=0;
7092 goto out;
7093diff -Nura php-4.4.2/TSRM/TSRM.h hardening-patch-4.4.2-0.4.15/TSRM/TSRM.h
7094--- php-4.4.2/TSRM/TSRM.h 2005-07-26 15:34:52.000000000 +0200
7095+++ hardening-patch-4.4.2-0.4.15/TSRM/TSRM.h 2006-09-05 20:30:33.000000000 +0200
7096@@ -33,6 +33,13 @@
7097 # define TSRM_API
7098 #endif
7099
7100+#if HARDENING_PATCH
7101+# if HAVE_REALPATH
7102+# undef realpath
7103+# define realpath php_realpath
7104+# endif
7105+#endif
7106+
7107 /* Only compile multi-threading functions if we're in ZTS mode */
7108 #ifdef ZTS
7109
7110@@ -84,6 +91,7 @@
7111
7112 #define THREAD_HASH_OF(thr,ts) (unsigned long)thr%(unsigned long)ts
7113
7114+
7115 #ifdef __cplusplus
7116 extern "C" {
7117 #endif
7118diff -Nura php-4.4.2/TSRM/tsrm_virtual_cwd.c hardening-patch-4.4.2-0.4.15/TSRM/tsrm_virtual_cwd.c
7119--- php-4.4.2/TSRM/tsrm_virtual_cwd.c 2006-01-01 14:46:48.000000000 +0100
7120+++ hardening-patch-4.4.2-0.4.15/TSRM/tsrm_virtual_cwd.c 2006-09-05 20:30:33.000000000 +0200
7121@@ -179,6 +179,178 @@
7122 return p;
7123 }
7124
7125+#if HARDENING_PATCH
7126+CWD_API char *php_realpath(const char *path, char *resolved)
7127+{
7128+ struct stat sb;
7129+ char *p, *q, *s;
7130+ size_t left_len, resolved_len;
7131+ unsigned symlinks;
7132+ int serrno, slen;
7133+ int is_dir = 1;
7134+ char left[PATH_MAX], next_token[PATH_MAX], symlink[PATH_MAX];
7135+
7136+ serrno = errno;
7137+ symlinks = 0;
7138+ if (path[0] == '/') {
7139+ resolved[0] = '/';
7140+ resolved[1] = '\0';
7141+ if (path[1] == '\0')
7142+ return (resolved);
7143+ resolved_len = 1;
7144+ left_len = strlcpy(left, path + 1, sizeof(left));
7145+ } else {
7146+ if (getcwd(resolved, PATH_MAX) == NULL) {
7147+ strlcpy(resolved, ".", PATH_MAX);
7148+ return (NULL);
7149+ }
7150+ resolved_len = strlen(resolved);
7151+ left_len = strlcpy(left, path, sizeof(left));
7152+ }
7153+ if (left_len >= sizeof(left) || resolved_len >= PATH_MAX) {
7154+ errno = ENAMETOOLONG;
7155+ return (NULL);
7156+ }
7157+
7158+ /*
7159+ * Iterate over path components in `left'.
7160+ */
7161+ while (left_len != 0) {
7162+ /*
7163+ * Extract the next path component and adjust `left'
7164+ * and its length.
7165+ */
7166+ p = strchr(left, '/');
7167+ s = p ? p : left + left_len;
7168+ if (s - left >= sizeof(next_token)) {
7169+ errno = ENAMETOOLONG;
7170+ return (NULL);
7171+ }
7172+ memcpy(next_token, left, s - left);
7173+ next_token[s - left] = '\0';
7174+ left_len -= s - left;
7175+ if (p != NULL)
7176+ memmove(left, s + 1, left_len + 1);
7177+ if (resolved[resolved_len - 1] != '/') {
7178+ if (resolved_len + 1 >= PATH_MAX) {
7179+ errno = ENAMETOOLONG;
7180+ return (NULL);
7181+ }
7182+ resolved[resolved_len++] = '/';
7183+ resolved[resolved_len] = '\0';
7184+ }
7185+ if (next_token[0] == '\0')
7186+ continue;
7187+ else if (strcmp(next_token, ".") == 0)
7188+ continue;
7189+ else if (strcmp(next_token, "..") == 0) {
7190+ /*
7191+ * Strip the last path component except when we have
7192+ * single "/"
7193+ */
7194+ if (!is_dir) {
7195+ errno = ENOENT;
7196+ return (NULL);
7197+ }
7198+ if (resolved_len > 1) {
7199+ resolved[resolved_len - 1] = '\0';
7200+ q = strrchr(resolved, '/');
7201+ *q = '\0';
7202+ resolved_len = q - resolved;
7203+ }
7204+ continue;
7205+ }
7206+
7207+ /*
7208+ * Append the next path component and lstat() it. If
7209+ * lstat() fails we still can return successfully if
7210+ * there are no more path components left.
7211+ */
7212+ resolved_len = strlcat(resolved, next_token, PATH_MAX);
7213+ if (resolved_len >= PATH_MAX) {
7214+ errno = ENAMETOOLONG;
7215+ return (NULL);
7216+ }
7217+ if (lstat(resolved, &sb) != 0) {
7218+ if (errno == ENOENT) {
7219+ if (p == NULL) {
7220+ errno = serrno;
7221+ return (resolved);
7222+ } else
7223+ /* dirty hack to support a vanilla PHP feature */
7224+ if (strstr(left, "/.") == NULL && strstr(left, "./") == NULL) {
7225+ resolved_len = strlcat(resolved, "/", PATH_MAX);
7226+ resolved_len = strlcat(resolved, left, PATH_MAX);
7227+ if (resolved_len >= PATH_MAX) {
7228+ errno = ENAMETOOLONG;
7229+ return (NULL);
7230+ }
7231+ errno = serrno;
7232+ return (resolved);
7233+ }
7234+ }
7235+ return (NULL);
7236+ }
7237+ if (S_ISLNK(sb.st_mode)) {
7238+ if (symlinks++ > MAXSYMLINKS) {
7239+ errno = ELOOP;
7240+ return (NULL);
7241+ }
7242+ slen = readlink(resolved, symlink, sizeof(symlink) - 1);
7243+ if (slen < 0)
7244+ return (NULL);
7245+ symlink[slen] = '\0';
7246+ if (symlink[0] == '/') {
7247+ resolved[1] = 0;
7248+ resolved_len = 1;
7249+ } else if (resolved_len > 1) {
7250+ /* Strip the last path component. */
7251+ resolved[resolved_len - 1] = '\0';
7252+ q = strrchr(resolved, '/');
7253+ *q = '\0';
7254+ resolved_len = q - resolved;
7255+ }
7256+
7257+ /*
7258+ * If there are any path components left, then
7259+ * append them to symlink. The result is placed
7260+ * in `left'.
7261+ */
7262+ if (p != NULL) {
7263+ if (symlink[slen - 1] != '/') {
7264+ if (slen + 1 >= sizeof(symlink)) {
7265+ errno = ENAMETOOLONG;
7266+ return (NULL);
7267+ }
7268+ symlink[slen] = '/';
7269+ symlink[slen + 1] = 0;
7270+ }
7271+ left_len = strlcat(symlink, left, sizeof(left));
7272+ if (left_len >= sizeof(left)) {
7273+ errno = ENAMETOOLONG;
7274+ return (NULL);
7275+ }
7276+ }
7277+ left_len = strlcpy(left, symlink, sizeof(left));
7278+ } else {
7279+ if (S_ISDIR(sb.st_mode)) {
7280+ is_dir = 1;
7281+ } else {
7282+ is_dir = 0;
7283+ }
7284+ }
7285+ }
7286+
7287+ /*
7288+ * Remove trailing slash except when the resolved pathname
7289+ * is a single "/".
7290+ */
7291+ if (resolved_len > 1 && resolved[resolved_len - 1] == '/')
7292+ resolved[resolved_len - 1] = '\0';
7293+ return (resolved);
7294+}
7295+#endif
7296+
7297 CWD_API void virtual_cwd_startup(void)
7298 {
7299 char cwd[MAXPATHLEN];
7300@@ -300,8 +472,11 @@
7301
7302 if (path_length == 0)
7303 return (0);
7304- if (path_length >= MAXPATHLEN)
7305+ if (path_length >= MAXPATHLEN) {
7306+ state->cwd[0] = 0;
7307+ state->cwd_length = 0;
7308 return (1);
7309+ }
7310
7311 #if !defined(TSRM_WIN32) && !defined(NETWARE)
7312 /* cwd_length can be 0 when getcwd() fails.
7313@@ -313,8 +488,9 @@
7314 path = resolved_path;
7315 path_length = strlen(path);
7316 } else {
7317- /* disable for now
7318- return 1; */
7319+ state->cwd[0] = 0;
7320+ state->cwd_length = 0;
7321+ return 1;
7322 }
7323 }
7324 } else { /* Concat current directory with relative path and then run realpath() on it */
7325@@ -323,6 +499,8 @@
7326
7327 ptr = tmp = (char *) malloc(state->cwd_length+path_length+sizeof("/"));
7328 if (!tmp) {
7329+ state->cwd[0] = 0;
7330+ state->cwd_length = 0;
7331 return 1;
7332 }
7333 memcpy(ptr, state->cwd, state->cwd_length);
7334@@ -332,6 +510,8 @@
7335 ptr += path_length;
7336 *ptr = '\0';
7337 if (strlen(tmp) >= MAXPATHLEN) {
7338+ state->cwd[0] = 0;
7339+ state->cwd_length = 0;
7340 free(tmp);
7341 return 1;
7342 }
7343@@ -340,9 +520,10 @@
7344 path = resolved_path;
7345 path_length = strlen(path);
7346 } else {
7347- /* disable for now
7348+ state->cwd[0] = 0;
7349+ state->cwd_length = 0;
7350 free(tmp);
7351- return 1; */
7352+ return 1;
7353 }
7354 }
7355 free(tmp);
7356diff -Nura php-4.4.2/TSRM/tsrm_virtual_cwd.h hardening-patch-4.4.2-0.4.15/TSRM/tsrm_virtual_cwd.h
7357--- php-4.4.2/TSRM/tsrm_virtual_cwd.h 2006-01-01 14:46:49.000000000 +0100
7358+++ hardening-patch-4.4.2-0.4.15/TSRM/tsrm_virtual_cwd.h 2006-09-05 20:30:33.000000000 +0200
7359@@ -128,6 +128,22 @@
7360
7361 typedef int (*verify_path_func)(const cwd_state *);
7362
7363+#ifndef HAVE_STRLCPY
7364+CWD_API size_t php_strlcpy(char *dst, const char *src, size_t siz);
7365+#undef strlcpy
7366+#define strlcpy php_strlcpy
7367+#endif
7368+
7369+#ifndef HAVE_STRLCAT
7370+CWD_API size_t php_strlcat(char *dst, const char *src, size_t siz);
7371+#undef strlcat
7372+#define strlcat php_strlcat
7373+#endif
7374+
7375+
7376+#if HARDENING_PATCH
7377+CWD_API char *php_realpath(const char *path, char *resolved);
7378+#endif
7379 CWD_API void virtual_cwd_startup(void);
7380 CWD_API void virtual_cwd_shutdown(void);
7381 CWD_API char *virtual_getcwd_ex(size_t *length TSRMLS_DC);
7382diff -Nura php-4.4.2/Zend/zend_alloc.c hardening-patch-4.4.2-0.4.15/Zend/zend_alloc.c
7383--- php-4.4.2/Zend/zend_alloc.c 2006-01-01 14:46:49.000000000 +0100
7384+++ hardening-patch-4.4.2-0.4.15/Zend/zend_alloc.c 2006-09-05 20:30:33.000000000 +0200
7385@@ -56,6 +56,11 @@
7386 # define END_MAGIC_SIZE 0
7387 #endif
7388
7389+#if HARDENING_PATCH_MM_PROTECT
7390+# define CANARY_SIZE sizeof(unsigned int)
7391+#else
7392+# define CANARY_SIZE 0
7393+#endif
7394
7395 # if MEMORY_LIMIT
7396 # if ZEND_DEBUG
7397@@ -64,7 +69,15 @@
7398 #define CHECK_MEMORY_LIMIT(s, rs) _CHECK_MEMORY_LIMIT(s, rs, NULL, 0)
7399 # endif
7400
7401-#define _CHECK_MEMORY_LIMIT(s, rs, file, lineno) { AG(allocated_memory) += rs;\
7402+#define _CHECK_MEMORY_LIMIT(s, rs, file, lineno) { if ((ssize_t)(rs) > (ssize_t)(INT_MAX - AG(allocated_memory))) { \
7403+ if (file) { \
7404+ fprintf(stderr, "Integer overflow in memory_limit check detected at %s:%d\n", file, lineno); \
7405+ } else { \
7406+ fprintf(stderr, "Integer overflow in memory_limit check detected\n"); \
7407+ } \
7408+ exit(1); \
7409+ } \
7410+ AG(allocated_memory) += rs;\
7411 if (AG(memory_limit)<AG(allocated_memory)) {\
7412 int php_mem_limit = AG(memory_limit); \
7413 AG(allocated_memory) -= rs; \
7414@@ -96,9 +109,17 @@
7415 if (p==AG(head)) { \
7416 AG(head) = p->pNext; \
7417 } else { \
7418+ if (p != p->pLast->pNext) { \
7419+ zend_security_log(S_MEMORY, "linked list corrupt on efree() - heap corruption detected"); \
7420+ exit(1); \
7421+ } \
7422 p->pLast->pNext = p->pNext; \
7423 } \
7424 if (p->pNext) { \
7425+ if (p != p->pNext->pLast) { \
7426+ zend_security_log(S_MEMORY, "linked list corrupt on efree() - heap corruption detected"); \
7427+ exit(1); \
7428+ } \
7429 p->pNext->pLast = p->pLast; \
7430 }
7431
7432@@ -111,7 +132,7 @@
7433 p->pLast = (zend_mem_header *) NULL;
7434
7435 #define DECLARE_CACHE_VARS() \
7436- unsigned int real_size; \
7437+ size_t real_size; \
7438 unsigned int cache_index
7439
7440 #define REAL_SIZE(size) ((size+7) & ~0x7)
7441@@ -126,12 +147,22 @@
7442
7443 ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
7444 {
7445- zend_mem_header *p;
7446+ zend_mem_header *p = NULL;
7447 DECLARE_CACHE_VARS();
7448 TSRMLS_FETCH();
7449
7450+#if HARDENING_PATCH_MM_PROTECT
7451+ if (size > LONG_MAX - sizeof(zend_mem_header) - MEM_HEADER_PADDING - END_MAGIC_SIZE - CANARY_SIZE) {
7452+ zend_security_log(S_MEMORY, "emalloc() - requested size would result in integer overflow");
7453+ exit(1);
7454+ }
7455+#endif
7456 CALCULATE_REAL_SIZE_AND_CACHE_INDEX(size);
7457
7458+ if (size > INT_MAX || SIZE < size) {
7459+ goto emalloc_error;
7460+ }
7461+
7462 if (!ZEND_DISABLE_MEMORY_CACHE && (CACHE_INDEX < MAX_CACHED_MEMORY) && (AG(cache_count)[CACHE_INDEX] > 0)) {
7463 p = AG(cache)[CACHE_INDEX][--AG(cache_count)[CACHE_INDEX]];
7464 #if ZEND_DEBUG
7465@@ -147,6 +178,10 @@
7466 AG(cache_stats)[CACHE_INDEX][1]++;
7467 memcpy((((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + size), &mem_block_end_magic, sizeof(long));
7468 #endif
7469+#if HARDENING_PATCH_MM_PROTECT
7470+ p->canary = HG(canary_1);
7471+ memcpy((((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + size + END_MAGIC_SIZE), &HG(canary_2), CANARY_SIZE);
7472+#endif
7473 p->cached = 0;
7474 p->size = size;
7475 return (void *)((char *)p + sizeof(zend_mem_header) + MEM_HEADER_PADDING);
7476@@ -162,9 +197,11 @@
7477 AG(allocated_memory_peak) = AG(allocated_memory);
7478 }
7479 #endif
7480- p = (zend_mem_header *) ZEND_DO_MALLOC(sizeof(zend_mem_header) + MEM_HEADER_PADDING + SIZE + END_MAGIC_SIZE);
7481+ p = (zend_mem_header *) ZEND_DO_MALLOC(sizeof(zend_mem_header) + MEM_HEADER_PADDING + SIZE + END_MAGIC_SIZE + CANARY_SIZE);
7482 }
7483
7484+emalloc_error:
7485+
7486 HANDLE_BLOCK_INTERRUPTIONS();
7487
7488 if (!p) {
7489@@ -192,7 +229,10 @@
7490 # endif
7491 memcpy((((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + size), &mem_block_end_magic, sizeof(long));
7492 #endif
7493-
7494+#if HARDENING_PATCH_MM_PROTECT
7495+ p->canary = HG(canary_1);
7496+ memcpy((((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + size + END_MAGIC_SIZE), &HG(canary_2), CANARY_SIZE);
7497+#endif
7498 HANDLE_UNBLOCK_INTERRUPTIONS();
7499 return (void *)((char *)p + sizeof(zend_mem_header) + MEM_HEADER_PADDING);
7500 }
7501@@ -219,17 +259,36 @@
7502 return emalloc_rel(lval + offset);
7503 }
7504 }
7505-
7506+
7507+#if HARDENING_PATCH
7508+ zend_security_log(S_MEMORY, "Possible integer overflow catched by safe_emalloc()");
7509+#endif
7510 zend_error(E_ERROR, "Possible integer overflow in memory allocation (%ld * %ld + %ld)", nmemb, size, offset);
7511 return 0;
7512 }
7513
7514 ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
7515 {
7516+#if HARDENING_PATCH_MM_PROTECT
7517+ unsigned int canary_2;
7518+#endif
7519 zend_mem_header *p = (zend_mem_header *) ((char *)ptr - sizeof(zend_mem_header) - MEM_HEADER_PADDING);
7520 DECLARE_CACHE_VARS();
7521 TSRMLS_FETCH();
7522
7523+#if HARDENING_PATCH_MM_PROTECT
7524+ if (p->canary != HG(canary_1)) goto efree_canary_mismatch;
7525+ memcpy(&canary_2, (((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + p->size + END_MAGIC_SIZE), CANARY_SIZE);
7526+ if (canary_2 != HG(canary_2)) {
7527+efree_canary_mismatch:
7528+ zend_security_log(S_MEMORY, "canary mismatch on efree() - heap overflow or double efree detected");
7529+ exit(1);
7530+ }
7531+ /* to catch double efree()s */
7532+ memset((((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + p->size + END_MAGIC_SIZE), 0, CANARY_SIZE);
7533+ p->canary = 0;
7534+#endif
7535+
7536 #if defined(ZTS) && TSRM_DEBUG
7537 if (p->thread_id != tsrm_thread_id()) {
7538 tsrm_error(TSRM_ERROR_LEVEL_ERROR, "Memory block allocated at %s:(%d) on thread %x freed at %s:(%d) on thread %x, ignoring",
7539@@ -274,6 +333,9 @@
7540 size_t _size = nmemb * size;
7541
7542 if (nmemb && (_size/nmemb!=size)) {
7543+#if HARDENING_PATCH
7544+ zend_security_log(S_MEMORY, "Possible integer overflow catched by ecalloc()");
7545+#endif
7546 fprintf(stderr,"FATAL: ecalloc(): Unable to allocate %ld * %ld bytes\n", (long) nmemb, (long) size);
7547 #if ZEND_DEBUG && HAVE_KILL && HAVE_GETPID
7548 kill(getpid(), SIGSEGV);
7549@@ -293,6 +355,9 @@
7550
7551 ZEND_API void *_erealloc(void *ptr, size_t size, int allow_failure ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
7552 {
7553+#if HARDENING_PATCH_MM_PROTECT
7554+ unsigned int canary_2;
7555+#endif
7556 zend_mem_header *p;
7557 zend_mem_header *orig;
7558 DECLARE_CACHE_VARS();
7559@@ -304,6 +369,16 @@
7560
7561 p = orig = (zend_mem_header *) ((char *)ptr-sizeof(zend_mem_header)-MEM_HEADER_PADDING);
7562
7563+#if HARDENING_PATCH_MM_PROTECT
7564+ if (p->canary != HG(canary_1)) goto erealloc_canary_mismatch;
7565+ memcpy(&canary_2, (((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + p->size + END_MAGIC_SIZE), CANARY_SIZE);
7566+ if (canary_2 != HG(canary_2)) {
7567+erealloc_canary_mismatch:
7568+ zend_security_log(S_MEMORY, "canary mismatch on erealloc() - heap overflow detected");
7569+ exit(1);
7570+ }
7571+#endif
7572+
7573 #if defined(ZTS) && TSRM_DEBUG
7574 if (p->thread_id != tsrm_thread_id()) {
7575 void *new_p;
7576@@ -320,6 +395,13 @@
7577 CALCULATE_REAL_SIZE_AND_CACHE_INDEX(size);
7578
7579 HANDLE_BLOCK_INTERRUPTIONS();
7580+
7581+ if (size > INT_MAX || SIZE < size) {
7582+ REMOVE_POINTER_FROM_LIST(p);
7583+ p = NULL;
7584+ goto erealloc_error;
7585+ }
7586+
7587 #if MEMORY_LIMIT
7588 CHECK_MEMORY_LIMIT(size - p->size, SIZE - REAL_SIZE(p->size));
7589 if (AG(allocated_memory) > AG(allocated_memory_peak)) {
7590@@ -327,7 +409,8 @@
7591 }
7592 #endif
7593 REMOVE_POINTER_FROM_LIST(p);
7594- p = (zend_mem_header *) ZEND_DO_REALLOC(p, sizeof(zend_mem_header)+MEM_HEADER_PADDING+SIZE+END_MAGIC_SIZE);
7595+ p = (zend_mem_header *) ZEND_DO_REALLOC(p, sizeof(zend_mem_header)+MEM_HEADER_PADDING+SIZE+END_MAGIC_SIZE+CANARY_SIZE);
7596+erealloc_error:
7597 if (!p) {
7598 if (!allow_failure) {
7599 fprintf(stderr,"FATAL: erealloc(): Unable to allocate %ld bytes\n", (long) size);
7600@@ -349,6 +432,9 @@
7601 memcpy((((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + size), &mem_block_end_magic, sizeof(long));
7602 #endif
7603
7604+#if HARDENING_PATCH_MM_PROTECT
7605+ memcpy((((char *) p) + sizeof(zend_mem_header) + MEM_HEADER_PADDING + size + END_MAGIC_SIZE), &HG(canary_2), CANARY_SIZE);
7606+#endif
7607 p->size = size;
7608
7609 HANDLE_UNBLOCK_INTERRUPTIONS();
7610@@ -423,6 +509,10 @@
7611 {
7612 AG(head) = NULL;
7613
7614+#if HARDENING_PATCH_MM_PROTECT
7615+ HG(canary_1) = zend_canary();
7616+ HG(canary_2) = zend_canary();
7617+#endif
7618 #if MEMORY_LIMIT
7619 AG(memory_limit) = 1<<30; /* ridiculous limit, effectively no limit */
7620 AG(allocated_memory) = 0;
7621diff -Nura php-4.4.2/Zend/zend_alloc.h hardening-patch-4.4.2-0.4.15/Zend/zend_alloc.h
7622--- php-4.4.2/Zend/zend_alloc.h 2006-01-01 14:46:49.000000000 +0100
7623+++ hardening-patch-4.4.2-0.4.15/Zend/zend_alloc.h 2006-09-05 20:30:33.000000000 +0200
7624@@ -32,6 +32,9 @@
7625 #define MEM_BLOCK_CACHED_MAGIC 0xFB8277DCL
7626
7627 typedef struct _zend_mem_header {
7628+#if HARDENING_PATCH_MM_PROTECT
7629+ unsigned int canary;
7630+#endif
7631 #if ZEND_DEBUG
7632 long magic;
7633 char *filename;
7634diff -Nura php-4.4.2/Zend/zend_builtin_functions.c hardening-patch-4.4.2-0.4.15/Zend/zend_builtin_functions.c
7635--- php-4.4.2/Zend/zend_builtin_functions.c 2006-01-01 14:46:49.000000000 +0100
7636+++ hardening-patch-4.4.2-0.4.15/Zend/zend_builtin_functions.c 2006-09-05 20:30:33.000000000 +0200
7637@@ -49,6 +49,9 @@
7638 static ZEND_FUNCTION(crash);
7639 #endif
7640 #endif
7641+#if HARDENING_PATCH_MM_PROTECT_DEBUG
7642+static ZEND_FUNCTION(heap_overflow);
7643+#endif
7644 static ZEND_FUNCTION(get_included_files);
7645 static ZEND_FUNCTION(is_subclass_of);
7646 static ZEND_FUNCTION(is_a);
7647@@ -101,6 +104,9 @@
7648 ZEND_FE(crash, NULL)
7649 #endif
7650 #endif
7651+#if HARDENING_PATCH_MM_PROTECT_DEBUG
7652+ ZEND_FE(heap_overflow, NULL)
7653+#endif
7654 ZEND_FE(get_included_files, NULL)
7655 ZEND_FALIAS(get_required_files, get_included_files, NULL)
7656 ZEND_FE(is_subclass_of, NULL)
7657@@ -805,6 +811,19 @@
7658
7659 #endif /* ZEND_DEBUG */
7660
7661+
7662+#if HARDENING_PATCH_MM_PROTECT_DEBUG
7663+ZEND_FUNCTION(heap_overflow)
7664+{
7665+ char *nowhere = emalloc(10);
7666+
7667+ memcpy(nowhere, "something1234567890", sizeof("something1234567890"));
7668+
7669+ efree(nowhere);
7670+}
7671+#endif
7672+
7673+
7674 /* {{{ proto array get_included_files(void)
7675 Returns an array with the file names that were include_once()'d */
7676 ZEND_FUNCTION(get_included_files)
7677diff -Nura php-4.4.2/Zend/zend.c hardening-patch-4.4.2-0.4.15/Zend/zend.c
7678--- php-4.4.2/Zend/zend.c 2006-01-01 14:46:49.000000000 +0100
7679+++ hardening-patch-4.4.2-0.4.15/Zend/zend.c 2006-09-05 20:30:33.000000000 +0200
7680@@ -53,6 +53,12 @@
7681 ZEND_API void (*zend_unblock_interruptions)(void);
7682 ZEND_API void (*zend_ticks_function)(int ticks);
7683 ZEND_API void (*zend_error_cb)(int type, const char *error_filename, const uint error_lineno, const char *format, va_list args);
7684+#if HARDENING_PATCH
7685+ZEND_API void (*zend_security_log)(int loglevel, char *fmt, ...);
7686+#endif
7687+#if HARDENING_PATCH_INC_PROTECT
7688+ZEND_API int (*zend_is_valid_include)(zval *z);
7689+#endif
7690
7691 void (*zend_on_timeout)(int seconds TSRMLS_DC);
7692
7693@@ -70,9 +76,391 @@
7694 return SUCCESS;
7695 }
7696
7697+#if HARDENING_PATCH
7698+static ZEND_INI_MH(OnUpdateHPHP_log_syslog)
7699+{
7700+ if (!new_value) {
7701+ EG(hphp_log_syslog) = S_ALL & ~S_SQL | S_MEMORY | S_INTERNAL;
7702+ } else {
7703+ EG(hphp_log_syslog) = atoi(new_value) | S_MEMORY | S_INTERNAL;
7704+ }
7705+ return SUCCESS;
7706+}
7707+static ZEND_INI_MH(OnUpdateHPHP_log_syslog_facility)
7708+{
7709+ if (!new_value) {
7710+ EG(hphp_log_syslog_facility) = LOG_USER;
7711+ } else {
7712+ EG(hphp_log_syslog_facility) = atoi(new_value);
7713+ }
7714+ return SUCCESS;
7715+}
7716+static ZEND_INI_MH(OnUpdateHPHP_log_syslog_priority)
7717+{
7718+ if (!new_value) {
7719+ EG(hphp_log_syslog_priority) = LOG_ALERT;
7720+ } else {
7721+ EG(hphp_log_syslog_priority) = atoi(new_value);
7722+ }
7723+ return SUCCESS;
7724+}
7725+static ZEND_INI_MH(OnUpdateHPHP_log_sapi)
7726+{
7727+ if (!new_value) {
7728+ EG(hphp_log_sapi) = S_ALL & ~S_SQL | S_INTERNAL;
7729+ } else {
7730+ EG(hphp_log_sapi) = atoi(new_value) | S_INTERNAL;
7731+ }
7732+ return SUCCESS;
7733+}
7734+static ZEND_INI_MH(OnUpdateHPHP_log_script)
7735+{
7736+ if (!new_value) {
7737+ EG(hphp_log_script) = S_ALL & (~S_MEMORY) & (~S_INTERNAL);
7738+ } else {
7739+ EG(hphp_log_script) = atoi(new_value) & (~S_MEMORY) & (~S_INTERNAL);
7740+ }
7741+ return SUCCESS;
7742+}
7743+static ZEND_INI_MH(OnUpdateHPHP_log_scriptname)
7744+{
7745+ if (EG(hphp_log_scriptname)) {
7746+ pefree(EG(hphp_log_scriptname),1);
7747+ }
7748+ EG(hphp_log_scriptname) = NULL;
7749+ if (new_value) {
7750+ EG(hphp_log_scriptname) = pestrdup(new_value,1);
7751+ }
7752+ return SUCCESS;
7753+}
7754+
7755+static ZEND_INI_MH(OnUpdateHPHP_include_whitelist)
7756+{
7757+ char *s = NULL, *e, *val;
7758+ unsigned long dummy = 1;
7759+
7760+ if (!new_value) {
7761+include_whitelist_destroy:
7762+ if (HG(include_whitelist)) {
7763+ zend_hash_destroy(HG(include_whitelist));
7764+ pefree(HG(include_whitelist),1);
7765+ }
7766+ HG(include_whitelist) = NULL;
7767+ return SUCCESS;
7768+ }
7769+ if (!(*new_value)) {
7770+ goto include_whitelist_destroy;
7771+ }
7772+
7773+ HG(include_whitelist) = pemalloc(sizeof(HashTable), 1);
7774+ zend_hash_init(HG(include_whitelist), 5, NULL, NULL, 1);
7775+
7776+ val = zend_str_tolower_dup(new_value, strlen(new_value));
7777+ e = val;
7778+
7779+ while (*e) {
7780+ switch (*e) {
7781+ case ' ':
7782+ case ',':
7783+ if (s) {
7784+ *e = '\0';
7785+ zend_hash_add(HG(include_whitelist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7786+ s = NULL;
7787+ }
7788+ break;
7789+ default:
7790+ if (!s) {
7791+ s = e;
7792+ }
7793+ break;
7794+ }
7795+ e++;
7796+ }
7797+ if (s) {
7798+ zend_hash_add(HG(include_whitelist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7799+ }
7800+ efree(val);
7801+
7802+ return SUCCESS;
7803+}
7804+
7805+static ZEND_INI_MH(OnUpdateHPHP_include_blacklist)
7806+{
7807+ char *s = NULL, *e, *val;
7808+ unsigned long dummy = 1;
7809+
7810+ if (!new_value) {
7811+include_blacklist_destroy:
7812+ if (HG(include_blacklist)) {
7813+ zend_hash_destroy(HG(include_blacklist));
7814+ pefree(HG(include_blacklist),1);
7815+ }
7816+ HG(include_blacklist) = NULL;
7817+ return SUCCESS;
7818+ }
7819+ if (!(*new_value)) {
7820+ goto include_blacklist_destroy;
7821+ }
7822+
7823+ HG(include_blacklist) = pemalloc(sizeof(HashTable), 1);
7824+ zend_hash_init(HG(include_blacklist), 5, NULL, NULL, 1);
7825+
7826+ val = zend_str_tolower_dup(new_value, strlen(new_value));
7827+ e = val;
7828+
7829+ while (*e) {
7830+ switch (*e) {
7831+ case ' ':
7832+ case ',':
7833+ if (s) {
7834+ *e = '\0';
7835+ zend_hash_add(HG(include_blacklist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7836+ s = NULL;
7837+ }
7838+ break;
7839+ default:
7840+ if (!s) {
7841+ s = e;
7842+ }
7843+ break;
7844+ }
7845+ e++;
7846+ }
7847+ if (s) {
7848+ zend_hash_add(HG(include_blacklist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7849+ }
7850+ efree(val);
7851+
7852+ return SUCCESS;
7853+}
7854+
7855+static ZEND_INI_MH(OnUpdateHPHP_eval_whitelist)
7856+{
7857+ char *s = NULL, *e, *val;
7858+ unsigned long dummy = 1;
7859+
7860+ if (!new_value) {
7861+eval_whitelist_destroy:
7862+ if (HG(eval_whitelist)) {
7863+ zend_hash_destroy(HG(eval_whitelist));
7864+ pefree(HG(eval_whitelist),1);
7865+ }
7866+ HG(eval_whitelist) = NULL;
7867+ return SUCCESS;
7868+ }
7869+ if (!(*new_value)) {
7870+ goto eval_whitelist_destroy;
7871+ }
7872+
7873+ HG(eval_whitelist) = pemalloc(sizeof(HashTable), 1);
7874+ zend_hash_init(HG(eval_whitelist), 5, NULL, NULL, 1);
7875+
7876+ val = zend_str_tolower_dup(new_value, strlen(new_value));
7877+ e = val;
7878+
7879+ while (*e) {
7880+ switch (*e) {
7881+ case ' ':
7882+ case ',':
7883+ if (s) {
7884+ *e = '\0';
7885+ zend_hash_add(HG(eval_whitelist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7886+ s = NULL;
7887+ }
7888+ break;
7889+ default:
7890+ if (!s) {
7891+ s = e;
7892+ }
7893+ break;
7894+ }
7895+ e++;
7896+ }
7897+ if (s) {
7898+ zend_hash_add(HG(eval_whitelist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7899+ }
7900+ efree(val);
7901+
7902+ return SUCCESS;
7903+}
7904+
7905+static ZEND_INI_MH(OnUpdateHPHP_eval_blacklist)
7906+{
7907+ char *s = NULL, *e, *val;
7908+ unsigned long dummy = 1;
7909+
7910+ if (!new_value) {
7911+eval_blacklist_destroy:
7912+ if (HG(eval_blacklist)) {
7913+ zend_hash_destroy(HG(eval_blacklist));
7914+ pefree(HG(eval_blacklist), 1);
7915+ }
7916+ HG(eval_blacklist) = NULL;
7917+ return SUCCESS;
7918+ }
7919+ if (!(*new_value)) {
7920+ goto eval_blacklist_destroy;
7921+ }
7922+
7923+ HG(eval_blacklist) = pemalloc(sizeof(HashTable), 1);
7924+ zend_hash_init(HG(eval_blacklist), 5, NULL, NULL, 1);
7925+
7926+ val = zend_str_tolower_dup(new_value, strlen(new_value));
7927+ e = val;
7928+
7929+ while (*e) {
7930+ switch (*e) {
7931+ case ' ':
7932+ case ',':
7933+ if (s) {
7934+ *e = '\0';
7935+ zend_hash_add(HG(eval_blacklist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7936+ s = NULL;
7937+ }
7938+ break;
7939+ default:
7940+ if (!s) {
7941+ s = e;
7942+ }
7943+ break;
7944+ }
7945+ e++;
7946+ }
7947+ if (s) {
7948+ zend_hash_add(HG(eval_blacklist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7949+ }
7950+ efree(val);
7951+
7952+
7953+ return SUCCESS;
7954+}
7955+
7956+static ZEND_INI_MH(OnUpdateHPHP_func_whitelist)
7957+{
7958+ char *s = NULL, *e, *val;
7959+ unsigned long dummy = 1;
7960+
7961+ if (!new_value) {
7962+func_whitelist_destroy:
7963+ if (HG(func_whitelist)) {
7964+ zend_hash_destroy(HG(func_whitelist));
7965+ pefree(HG(func_whitelist),1);
7966+ }
7967+ HG(func_whitelist) = NULL;
7968+ return SUCCESS;
7969+ }
7970+ if (!(*new_value)) {
7971+ goto func_whitelist_destroy;
7972+ }
7973+
7974+ HG(func_whitelist) = pemalloc(sizeof(HashTable), 1);
7975+ zend_hash_init(HG(func_whitelist), 5, NULL, NULL, 1);
7976+
7977+ val = zend_str_tolower_dup(new_value, strlen(new_value));
7978+ e = val;
7979+
7980+ while (*e) {
7981+ switch (*e) {
7982+ case ' ':
7983+ case ',':
7984+ if (s) {
7985+ *e = '\0';
7986+ zend_hash_add(HG(func_whitelist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
7987+ s = NULL;
7988+ }
7989+ break;
7990+ default:
7991+ if (!s) {
7992+ s = e;
7993+ }
7994+ break;
7995+ }
7996+ e++;
7997+ }
7998+ if (s) {
7999+ zend_hash_add(HG(func_whitelist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
8000+ }
8001+ efree(val);
8002+
8003+ return SUCCESS;
8004+}
8005+
8006+static ZEND_INI_MH(OnUpdateHPHP_func_blacklist)
8007+{
8008+ char *s = NULL, *e, *val;
8009+ unsigned long dummy = 1;
8010+
8011+ if (!new_value) {
8012+func_blacklist_destroy:
8013+ if (HG(func_blacklist)) {
8014+ zend_hash_destroy(HG(func_blacklist));
8015+ pefree(HG(func_blacklist),1);
8016+ }
8017+ HG(func_blacklist) = NULL;
8018+ return SUCCESS;
8019+ }
8020+ if (!(*new_value)) {
8021+ goto func_blacklist_destroy;
8022+ }
8023+
8024+ HG(func_blacklist) = pemalloc(sizeof(HashTable), 1);
8025+ zend_hash_init(HG(func_blacklist), 5, NULL, NULL, 1);
8026+
8027+ val = zend_str_tolower_dup(new_value, strlen(new_value));
8028+ e = val;
8029+
8030+ while (*e) {
8031+ switch (*e) {
8032+ case ' ':
8033+ case ',':
8034+ if (s) {
8035+ *e = '\0';
8036+ zend_hash_add(HG(func_blacklist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
8037+ s = NULL;
8038+ }
8039+ break;
8040+ default:
8041+ if (!s) {
8042+ s = e;
8043+ }
8044+ break;
8045+ }
8046+ e++;
8047+ }
8048+ if (s) {
8049+ zend_hash_add(HG(func_blacklist), s, e-s+1, &dummy, sizeof(unsigned long), NULL);
8050+ }
8051+ efree(val);
8052+
8053+
8054+ return SUCCESS;
8055+}
8056+
8057+#endif
8058
8059 ZEND_INI_BEGIN()
8060 ZEND_INI_ENTRY("error_reporting", NULL, ZEND_INI_ALL, OnUpdateErrorReporting)
8061+#if HARDENING_PATCH
8062+ ZEND_INI_ENTRY("hphp.log.syslog", NULL, ZEND_INI_SYSTEM, OnUpdateHPHP_log_syslog)
8063+ ZEND_INI_ENTRY("hphp.log.syslog.facility", NULL, ZEND_INI_SYSTEM, OnUpdateHPHP_log_syslog_facility)
8064+ ZEND_INI_ENTRY("hphp.log.syslog.priority", NULL, ZEND_INI_SYSTEM, OnUpdateHPHP_log_syslog_priority)
8065+ ZEND_INI_ENTRY("hphp.log.sapi", NULL, ZEND_INI_SYSTEM, OnUpdateHPHP_log_sapi)
8066+ ZEND_INI_ENTRY("hphp.log.script", NULL, ZEND_INI_SYSTEM, OnUpdateHPHP_log_script)
8067+ ZEND_INI_ENTRY("hphp.log.script.name", NULL, ZEND_INI_SYSTEM, OnUpdateHPHP_log_scriptname)
8068+ STD_ZEND_INI_BOOLEAN("hphp.log.use-x-forwarded-for", "0", ZEND_INI_SYSTEM, OnUpdateBool, hphp_log_use_x_forwarded_for, zend_executor_globals, executor_globals)
8069+
8070+ ZEND_INI_ENTRY("hphp.executor.include.whitelist", NULL, ZEND_INI_SYSTEM, OnUpdateHPHP_include_whitelist)
8071+ ZEND_INI_ENTRY("hphp.executor.include.blacklist", NULL, ZEND_INI_SYSTEM, OnUpdateHPHP_include_blacklist)
8072+ ZEND_INI_ENTRY("hphp.executor.eval.whitelist", NULL, ZEND_INI_PERDIR|ZEND_INI_SYSTEM, OnUpdateHPHP_eval_whitelist)
8073+ ZEND_INI_ENTRY("hphp.executor.eval.blacklist", NULL, ZEND_INI_PERDIR|ZEND_INI_SYSTEM, OnUpdateHPHP_eval_blacklist)
8074+ ZEND_INI_ENTRY("hphp.executor.func.whitelist", NULL, ZEND_INI_PERDIR|ZEND_INI_SYSTEM, OnUpdateHPHP_func_whitelist)
8075+ ZEND_INI_ENTRY("hphp.executor.func.blacklist", NULL, ZEND_INI_PERDIR|ZEND_INI_SYSTEM, OnUpdateHPHP_func_blacklist)
8076+
8077+ STD_ZEND_INI_ENTRY("hphp.executor.max_depth", "0", ZEND_INI_PERDIR|ZEND_INI_SYSTEM, OnUpdateLong, hphp_executor_max_depth, zend_executor_globals, executor_globals)
8078+ STD_ZEND_INI_BOOLEAN("hphp.sql.bailout_on_error", "0", ZEND_INI_PERDIR|ZEND_INI_SYSTEM, OnUpdateBool, hphp_sql_bailout_on_error, hardened_globals_struct, hardened_globals)
8079+ STD_ZEND_INI_BOOLEAN("hphp.multiheader", "0", ZEND_INI_PERDIR|ZEND_INI_SYSTEM, OnUpdateBool, hphp_multiheader, hardened_globals_struct, hardened_globals)
8080+ STD_ZEND_INI_ENTRY("hphp.mail.protect", "0", ZEND_INI_PERDIR|ZEND_INI_SYSTEM, OnUpdateLong, hphp_mailprotect, hardened_globals_struct, hardened_globals)
8081+#endif
8082 ZEND_INI_END()
8083
8084
8085@@ -354,8 +742,12 @@
8086 zend_init_rsrc_plist(TSRMLS_C);
8087 EG(lambda_count)=0;
8088 EG(user_error_handler) = NULL;
8089+ EG(in_code_type) = 0;
8090 EG(in_execution) = 0;
8091 EG(current_execute_data) = NULL;
8092+#if HARDENING_PATCH
8093+ EG(hphp_log_scriptname) = NULL;
8094+#endif
8095 }
8096
8097
8098@@ -420,6 +812,14 @@
8099 extern zend_scanner_globals language_scanner_globals;
8100 #endif
8101
8102+ /* Set up Hardening-Patch utility functions first */
8103+#if HARDENING_PATCH
8104+ zend_security_log = utility_functions->security_log_function;
8105+#endif
8106+#if HARDENING_PATCH_INC_PROTECT
8107+ zend_is_valid_include = utility_functions->is_valid_include;
8108+#endif
8109+
8110 #ifdef ZTS
8111 ts_allocate_id(&alloc_globals_id, sizeof(zend_alloc_globals), (ts_allocate_ctor) alloc_globals_ctor, (ts_allocate_dtor) alloc_globals_dtor);
8112 #else
8113@@ -619,6 +1019,7 @@
8114 }
8115 CG(unclean_shutdown) = 1;
8116 CG(in_compilation) = EG(in_execution) = 0;
8117+ EG(in_code_type) = 0;
8118 EG(current_execute_data) = NULL;
8119 longjmp(EG(bailout), FAILURE);
8120 }
8121diff -Nura php-4.4.2/Zend/zend_canary.c hardening-patch-4.4.2-0.4.15/Zend/zend_canary.c
8122--- php-4.4.2/Zend/zend_canary.c 1970-01-01 01:00:00.000000000 +0100
8123+++ hardening-patch-4.4.2-0.4.15/Zend/zend_canary.c 2006-09-05 20:30:33.000000000 +0200
8124@@ -0,0 +1,58 @@
8125+/*
8126+ +----------------------------------------------------------------------+
8127+ | Hardening-Patch for PHP |
8128+ +----------------------------------------------------------------------+
8129+ | Copyright (c) 2004-2005 Stefan Esser |
8130+ +----------------------------------------------------------------------+
8131+ | This source file is subject to version 2.02 of the PHP license, |
8132+ | that is bundled with this package in the file LICENSE, and is |
8133+ | available at through the world-wide-web at |
8134+ | http://www.php.net/license/2_02.txt. |
8135+ | If you did not receive a copy of the PHP license and are unable to |
8136+ | obtain it through the world-wide-web, please send a note to |
8137+ | license@php.net so we can mail you a copy immediately. |
8138+ +----------------------------------------------------------------------+
8139+ | Author: Stefan Esser <sesser@hardened-php.net> |
8140+ +----------------------------------------------------------------------+
8141+ */
8142+/* $Id: zend_canary.c,v 1.1 2004/11/26 12:45:41 ionic Exp $ */
8143+
8144+#include "zend.h"
8145+
8146+#include <stdio.h>
8147+#include <stdlib.h>
8148+
8149+
8150+#if HARDENING_PATCH_MM_PROTECT || HARDENING_PATCH_LL_PROTECT || HARDENING_PATCH_HASH_PROTECT
8151+
8152+/* will be replaced later with more compatible method */
8153+ZEND_API unsigned int zend_canary()
8154+{
8155+ time_t t;
8156+ unsigned int canary;
8157+ int fd;
8158+
8159+ fd = open("/dev/urandom", 0);
8160+ if (fd != -1) {
8161+ int r = read(fd, &canary, sizeof(canary));
8162+ close(fd);
8163+ if (r == sizeof(canary)) {
8164+ return (canary);
8165+ }
8166+ }
8167+ /* not good but we never want to do this */
8168+ time(&t);
8169+ canary = *(unsigned int *)&t + getpid() << 16;
8170+ return (canary);
8171+}
8172+#endif
8173+
8174+
8175+/*
8176+ * Local variables:
8177+ * tab-width: 4
8178+ * c-basic-offset: 4
8179+ * End:
8180+ * vim600: sw=4 ts=4 fdm=marker
8181+ * vim<600: sw=4 ts=4
8182+ */
8183diff -Nura php-4.4.2/Zend/zend_compile.c hardening-patch-4.4.2-0.4.15/Zend/zend_compile.c
8184--- php-4.4.2/Zend/zend_compile.c 2006-01-01 14:46:49.000000000 +0100
8185+++ hardening-patch-4.4.2-0.4.15/Zend/zend_compile.c 2006-09-05 20:30:33.000000000 +0200
8186@@ -768,6 +768,13 @@
8187 op_array.function_name = name;
8188 op_array.arg_types = NULL;
8189 op_array.return_reference = return_reference;
8190+#if HARDENING_PATCH
8191+ if (EG(in_code_type)==ZEND_EVAL_CODE) {
8192+ op_array.created_by_eval = 1;
8193+ } else {
8194+ op_array.created_by_eval = 0;
8195+ }
8196+#endif
8197
8198 if (is_method) {
8199 if (zend_hash_add(&CG(active_class_entry)->function_table, name, name_len+1, &op_array, sizeof(zend_op_array), (void **) &CG(active_op_array)) == FAILURE) {
8200diff -Nura php-4.4.2/Zend/zend_compile.h hardening-patch-4.4.2-0.4.15/Zend/zend_compile.h
8201--- php-4.4.2/Zend/zend_compile.h 2006-01-01 14:46:49.000000000 +0100
8202+++ hardening-patch-4.4.2-0.4.15/Zend/zend_compile.h 2006-09-05 20:30:33.000000000 +0200
8203@@ -106,6 +106,9 @@
8204 char *filename;
8205
8206 void *reserved[ZEND_MAX_RESERVED_RESOURCES];
8207+#if HARDENING_PATCH
8208+ zend_bool created_by_eval;
8209+#endif
8210 };
8211
8212
8213@@ -549,6 +552,7 @@
8214 #define ZEND_USER_FUNCTION 2
8215 #define ZEND_OVERLOADED_FUNCTION 3
8216 #define ZEND_EVAL_CODE 4
8217+#define ZEND_SANDBOX_CODE 6
8218
8219 #define ZEND_INTERNAL_CLASS 1
8220 #define ZEND_USER_CLASS 2
8221diff -Nura php-4.4.2/Zend/zend_constants.c hardening-patch-4.4.2-0.4.15/Zend/zend_constants.c
8222--- php-4.4.2/Zend/zend_constants.c 2006-01-01 14:46:49.000000000 +0100
8223+++ hardening-patch-4.4.2-0.4.15/Zend/zend_constants.c 2006-09-05 20:30:33.000000000 +0200
8224@@ -111,6 +111,74 @@
8225 REGISTER_MAIN_LONG_CONSTANT("E_USER_NOTICE", E_USER_NOTICE, CONST_PERSISTENT | CONST_CS);
8226
8227 REGISTER_MAIN_LONG_CONSTANT("E_ALL", E_ALL, CONST_PERSISTENT | CONST_CS);
8228+#if HARDENING_PATCH
8229+ REGISTER_MAIN_LONG_CONSTANT("S_MEMORY", S_MEMORY, CONST_PERSISTENT | CONST_CS);
8230+ REGISTER_MAIN_LONG_CONSTANT("S_VARS", S_VARS, CONST_PERSISTENT | CONST_CS);
8231+ REGISTER_MAIN_LONG_CONSTANT("S_FILES", S_FILES, CONST_PERSISTENT | CONST_CS);
8232+ REGISTER_MAIN_LONG_CONSTANT("S_INCLUDE", S_INCLUDE, CONST_PERSISTENT | CONST_CS);
8233+ REGISTER_MAIN_LONG_CONSTANT("S_SQL", S_SQL, CONST_PERSISTENT | CONST_CS);
8234+ REGISTER_MAIN_LONG_CONSTANT("S_EXECUTOR", S_EXECUTOR, CONST_PERSISTENT | CONST_CS);
8235+ REGISTER_MAIN_LONG_CONSTANT("S_MAIL", S_MAIL, CONST_PERSISTENT | CONST_CS);
8236+ REGISTER_MAIN_LONG_CONSTANT("S_MISC", S_MISC, CONST_PERSISTENT | CONST_CS);
8237+ REGISTER_MAIN_LONG_CONSTANT("S_INTERNAL", S_INTERNAL, CONST_PERSISTENT | CONST_CS);
8238+ REGISTER_MAIN_LONG_CONSTANT("S_ALL", S_ALL, CONST_PERSISTENT | CONST_CS);
8239+
8240+ /* error levels */
8241+ REGISTER_MAIN_LONG_CONSTANT("LOG_EMERG", LOG_EMERG, CONST_CS | CONST_PERSISTENT); /* system unusable */
8242+ REGISTER_MAIN_LONG_CONSTANT("LOG_ALERT", LOG_ALERT, CONST_CS | CONST_PERSISTENT); /* immediate action required */
8243+ REGISTER_MAIN_LONG_CONSTANT("LOG_CRIT", LOG_CRIT, CONST_CS | CONST_PERSISTENT); /* critical conditions */
8244+ REGISTER_MAIN_LONG_CONSTANT("LOG_ERR", LOG_ERR, CONST_CS | CONST_PERSISTENT);
8245+ REGISTER_MAIN_LONG_CONSTANT("LOG_WARNING", LOG_WARNING, CONST_CS | CONST_PERSISTENT);
8246+ REGISTER_MAIN_LONG_CONSTANT("LOG_NOTICE", LOG_NOTICE, CONST_CS | CONST_PERSISTENT);
8247+ REGISTER_MAIN_LONG_CONSTANT("LOG_INFO", LOG_INFO, CONST_CS | CONST_PERSISTENT);
8248+ REGISTER_MAIN_LONG_CONSTANT("LOG_DEBUG", LOG_DEBUG, CONST_CS | CONST_PERSISTENT);
8249+ /* facility: type of program logging the message */
8250+ REGISTER_MAIN_LONG_CONSTANT("LOG_KERN", LOG_KERN, CONST_CS | CONST_PERSISTENT);
8251+ REGISTER_MAIN_LONG_CONSTANT("LOG_USER", LOG_USER, CONST_CS | CONST_PERSISTENT); /* generic user level */
8252+ REGISTER_MAIN_LONG_CONSTANT("LOG_MAIL", LOG_MAIL, CONST_CS | CONST_PERSISTENT); /* log to email */
8253+ REGISTER_MAIN_LONG_CONSTANT("LOG_DAEMON", LOG_DAEMON, CONST_CS | CONST_PERSISTENT); /* other system daemons */
8254+ REGISTER_MAIN_LONG_CONSTANT("LOG_AUTH", LOG_AUTH, CONST_CS | CONST_PERSISTENT);
8255+ REGISTER_MAIN_LONG_CONSTANT("LOG_SYSLOG", LOG_SYSLOG, CONST_CS | CONST_PERSISTENT);
8256+ REGISTER_MAIN_LONG_CONSTANT("LOG_LPR", LOG_LPR, CONST_CS | CONST_PERSISTENT);
8257+#ifdef LOG_NEWS
8258+ /* No LOG_NEWS on HP-UX */
8259+ REGISTER_MAIN_LONG_CONSTANT("LOG_NEWS", LOG_NEWS, CONST_CS | CONST_PERSISTENT); /* usenet new */
8260+#endif
8261+#ifdef LOG_UUCP
8262+ /* No LOG_UUCP on HP-UX */
8263+ REGISTER_MAIN_LONG_CONSTANT("LOG_UUCP", LOG_UUCP, CONST_CS | CONST_PERSISTENT);
8264+#endif
8265+#ifdef LOG_CRON
8266+ /* apparently some systems don't have this one */
8267+ REGISTER_MAIN_LONG_CONSTANT("LOG_CRON", LOG_CRON, CONST_CS | CONST_PERSISTENT);
8268+#endif
8269+#ifdef LOG_AUTHPRIV
8270+ /* AIX doesn't have LOG_AUTHPRIV */
8271+ REGISTER_MAIN_LONG_CONSTANT("LOG_AUTHPRIV", LOG_AUTHPRIV, CONST_CS | CONST_PERSISTENT);
8272+#endif
8273+#if !defined(PHP_WIN32) && !defined(NETWARE)
8274+ REGISTER_MAIN_LONG_CONSTANT("LOG_LOCAL0", LOG_LOCAL0, CONST_CS | CONST_PERSISTENT);
8275+ REGISTER_MAIN_LONG_CONSTANT("LOG_LOCAL1", LOG_LOCAL1, CONST_CS | CONST_PERSISTENT);
8276+ REGISTER_MAIN_LONG_CONSTANT("LOG_LOCAL2", LOG_LOCAL2, CONST_CS | CONST_PERSISTENT);
8277+ REGISTER_MAIN_LONG_CONSTANT("LOG_LOCAL3", LOG_LOCAL3, CONST_CS | CONST_PERSISTENT);
8278+ REGISTER_MAIN_LONG_CONSTANT("LOG_LOCAL4", LOG_LOCAL4, CONST_CS | CONST_PERSISTENT);
8279+ REGISTER_MAIN_LONG_CONSTANT("LOG_LOCAL5", LOG_LOCAL5, CONST_CS | CONST_PERSISTENT);
8280+ REGISTER_MAIN_LONG_CONSTANT("LOG_LOCAL6", LOG_LOCAL6, CONST_CS | CONST_PERSISTENT);
8281+ REGISTER_MAIN_LONG_CONSTANT("LOG_LOCAL7", LOG_LOCAL7, CONST_CS | CONST_PERSISTENT);
8282+#endif
8283+ /* options */
8284+ REGISTER_MAIN_LONG_CONSTANT("LOG_PID", LOG_PID, CONST_CS | CONST_PERSISTENT);
8285+ REGISTER_MAIN_LONG_CONSTANT("LOG_CONS", LOG_CONS, CONST_CS | CONST_PERSISTENT);
8286+ REGISTER_MAIN_LONG_CONSTANT("LOG_ODELAY", LOG_ODELAY, CONST_CS | CONST_PERSISTENT);
8287+ REGISTER_MAIN_LONG_CONSTANT("LOG_NDELAY", LOG_NDELAY, CONST_CS | CONST_PERSISTENT);
8288+#ifdef LOG_NOWAIT
8289+ REGISTER_MAIN_LONG_CONSTANT("LOG_NOWAIT", LOG_NOWAIT, CONST_CS | CONST_PERSISTENT);
8290+#endif
8291+#ifdef LOG_PERROR
8292+ /* AIX doesn't have LOG_PERROR */
8293+ REGISTER_MAIN_LONG_CONSTANT("LOG_PERROR", LOG_PERROR, CONST_CS | CONST_PERSISTENT); /*log to stderr*/
8294+#endif
8295+#endif
8296
8297 /* true/false constants */
8298 {
8299diff -Nura php-4.4.2/Zend/zend_errors.h hardening-patch-4.4.2-0.4.15/Zend/zend_errors.h
8300--- php-4.4.2/Zend/zend_errors.h 2006-01-01 14:46:49.000000000 +0100
8301+++ hardening-patch-4.4.2-0.4.15/Zend/zend_errors.h 2006-09-05 20:30:33.000000000 +0200
8302@@ -36,5 +36,18 @@
8303 #define E_ALL (E_ERROR | E_WARNING | E_PARSE | E_NOTICE | E_CORE_ERROR | E_CORE_WARNING | E_COMPILE_ERROR | E_COMPILE_WARNING | E_USER_ERROR | E_USER_WARNING | E_USER_NOTICE)
8304 #define E_CORE (E_CORE_ERROR | E_CORE_WARNING)
8305
8306+#if HARDENING_PATCH
8307+#define S_MEMORY (1<<0L)
8308+#define S_VARS (1<<1L)
8309+#define S_FILES (1<<2L)
8310+#define S_INCLUDE (1<<3L)
8311+#define S_SQL (1<<4L)
8312+#define S_EXECUTOR (1<<5L)
8313+#define S_MAIL (1<<6L)
8314+#define S_MISC (1<<30L)
8315+#define S_INTERNAL (1<<29L)
8316+#define S_ALL (S_MEMORY | S_VARS | S_INCLUDE | S_FILES | S_MAIL | S_MISC | S_SQL | S_EXECUTOR)
8317+#endif
8318+
8319 #endif /* ZEND_ERRORS_H */
8320
8321diff -Nura php-4.4.2/Zend/zend_execute_API.c hardening-patch-4.4.2-0.4.15/Zend/zend_execute_API.c
8322--- php-4.4.2/Zend/zend_execute_API.c 2006-01-01 14:46:49.000000000 +0100
8323+++ hardening-patch-4.4.2-0.4.15/Zend/zend_execute_API.c 2006-09-05 20:30:33.000000000 +0200
8324@@ -142,6 +142,7 @@
8325 EG(class_table) = CG(class_table);
8326
8327 EG(in_execution) = 0;
8328+ EG(in_code_type) = 0;
8329
8330 zend_ptr_stack_init(&EG(argument_stack));
8331
8332@@ -431,12 +432,14 @@
8333 zend_execute_data execute_data;
8334
8335 /* Initialize execute_data */
8336+ memset(&execute_data, 0, sizeof(execute_data));
8337 EX(fbc) = NULL;
8338 EX(object).ptr = NULL;
8339 EX(ce) = NULL;
8340 EX(Ts) = NULL;
8341 EX(op_array) = NULL;
8342 EX(opline) = NULL;
8343+ EX(execute_depth) = 0;
8344
8345 *retval_ptr_ptr = NULL;
8346
8347@@ -494,6 +497,39 @@
8348 zval_dtor(&function_name_copy);
8349 return FAILURE;
8350 }
8351+#if HARDENING_PATCH
8352+ if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION) {
8353+ if (EG(in_code_type) == ZEND_EVAL_CODE) {
8354+ if (HG(eval_whitelist) != NULL) {
8355+ if (!zend_hash_exists(HG(eval_whitelist), function_name_copy.value.str.val, function_name_copy.value.str.len+1)) {
8356+ zend_security_log(S_EXECUTOR, "function outside of eval whitelist called: %s()", function_name_copy.value.str.val);
8357+ zval_dtor(&function_name_copy);
8358+ zend_bailout();
8359+ }
8360+ } else if (HG(eval_blacklist) != NULL) {
8361+ if (zend_hash_exists(HG(eval_blacklist), function_name_copy.value.str.val, function_name_copy.value.str.len+1)) {
8362+ zend_security_log(S_EXECUTOR, "function within eval blacklist called: %s()", function_name_copy.value.str.val);
8363+ zval_dtor(&function_name_copy);
8364+ zend_bailout();
8365+ }
8366+ }
8367+ }
8368+
8369+ if (HG(func_whitelist) != NULL) {
8370+ if (!zend_hash_exists(HG(func_whitelist), function_name_copy.value.str.val, function_name_copy.value.str.len+1)) {
8371+ zend_security_log(S_EXECUTOR, "function outside of whitelist called: %s()", function_name_copy.value.str.val);
8372+ zval_dtor(&function_name_copy);
8373+ zend_bailout();
8374+ }
8375+ } else if (HG(func_blacklist) != NULL) {
8376+ if (zend_hash_exists(HG(func_blacklist), function_name_copy.value.str.val, function_name_copy.value.str.len+1)) {
8377+ zend_security_log(S_EXECUTOR, "function within blacklist called: %s()", function_name_copy.value.str.val);
8378+ zval_dtor(&function_name_copy);
8379+ zend_bailout();
8380+ }
8381+ }
8382+ }
8383+#endif
8384 zval_dtor(&function_name_copy);
8385
8386 for (i=0; i<param_count; i++) {
8387@@ -606,8 +642,7 @@
8388 return SUCCESS;
8389 }
8390
8391-
8392-ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSRMLS_DC)
8393+ZEND_API int zend_eval_string_ex(char *str, zval *retval_ptr, char *string_name, int type TSRMLS_DC)
8394 {
8395 zval pv;
8396 zend_op_array *new_op_array;
8397@@ -640,6 +675,7 @@
8398 zval **original_return_value_ptr_ptr = EG(return_value_ptr_ptr);
8399 zend_op **original_opline_ptr = EG(opline_ptr);
8400
8401+ new_op_array->type = type;
8402 EG(return_value_ptr_ptr) = &local_retval_ptr;
8403 EG(active_op_array) = new_op_array;
8404 EG(no_extensions)=1;
8405@@ -673,6 +709,10 @@
8406 return retval;
8407 }
8408
8409+ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSRMLS_DC)
8410+{
8411+ return (zend_eval_string_ex(str, retval_ptr, string_name, ZEND_EVAL_CODE TSRMLS_CC));
8412+}
8413
8414 void execute_new_code(TSRMLS_D)
8415 {
8416diff -Nura php-4.4.2/Zend/zend_execute.c hardening-patch-4.4.2-0.4.15/Zend/zend_execute.c
8417--- php-4.4.2/Zend/zend_execute.c 2006-01-01 14:46:49.000000000 +0100
8418+++ hardening-patch-4.4.2-0.4.15/Zend/zend_execute.c 2006-09-05 20:30:33.000000000 +0200
8419@@ -1042,6 +1042,7 @@
8420 zend_execute_data execute_data;
8421
8422 /* Initialize execute_data */
8423+ memset(&execute_data, 0, sizeof(execute_data));
8424 EX(fbc) = NULL;
8425 EX(ce) = NULL;
8426 EX(object).ptr = NULL;
8427@@ -1053,9 +1054,21 @@
8428 }
8429 EX(prev_execute_data) = EG(current_execute_data);
8430 EX(original_in_execution)=EG(in_execution);
8431+ EX(original_in_code_type)=EG(in_code_type);
8432
8433 EG(current_execute_data) = &execute_data;
8434
8435+#if HARDENING_PATCH
8436+ EX(execute_depth) = 0;
8437+
8438+ if ((op_array->type == ZEND_EVAL_CODE || op_array->created_by_eval) && EG(in_code_type) != ZEND_SANDBOX_CODE) {
8439+ EG(in_code_type) = ZEND_EVAL_CODE;
8440+ } else if (op_array->type == ZEND_SANDBOX_CODE) {
8441+ EG(in_code_type) = ZEND_SANDBOX_CODE;
8442+ op_array->type = ZEND_EVAL_CODE;
8443+ }
8444+#endif
8445+
8446 EG(in_execution) = 1;
8447 if (op_array->start_op) {
8448 EX(opline) = op_array->start_op;
8449@@ -1087,6 +1100,19 @@
8450 }
8451 }
8452
8453+#if HARDENING_PATCH
8454+ if (EX(prev_execute_data) == NULL) {
8455+ EX(execute_depth) = 0;
8456+ } else {
8457+ EX(execute_depth) = EX(prev_execute_data)->execute_depth + 1;
8458+ }
8459+
8460+ if (EG(hphp_executor_max_depth) > 0 && EX(execute_depth) > EG(hphp_executor_max_depth)) {
8461+ zend_security_log(S_EXECUTOR, "Maximum execution depth of %u violated", EG(hphp_executor_max_depth));
8462+ zend_bailout();
8463+ }
8464+#endif
8465+
8466 while (1) {
8467 #ifdef ZEND_WIN32
8468 if (EG(timed_out)) {
8469@@ -1634,6 +1660,36 @@
8470 if (zend_hash_find(active_function_table, function_name->value.str.val, function_name->value.str.len+1, (void **) &function)==FAILURE) {
8471 zend_error(E_ERROR, "Call to undefined function: %s()", function_name->value.str.val);
8472 }
8473+#if HARDENING_PATCH
8474+ if (active_function_table == EG(function_table)) {
8475+ if (EG(in_code_type) == ZEND_EVAL_CODE) {
8476+ if (HG(eval_whitelist) != NULL) {
8477+ if (!zend_hash_exists(HG(eval_whitelist), function_name->value.str.val, function_name->value.str.len+1)) {
8478+ zend_security_log(S_EXECUTOR, "function outside of eval whitelist called: %s()", function_name->value.str.val);
8479+ zend_bailout();
8480+ }
8481+ } else if (HG(eval_blacklist) != NULL) {
8482+ if (zend_hash_exists(HG(eval_blacklist), function_name->value.str.val, function_name->value.str.len+1)) {
8483+ zend_security_log(S_EXECUTOR, "function within eval blacklist called: %s()", function_name->value.str.val);
8484+ zend_bailout();
8485+ }
8486+ }
8487+ }
8488+
8489+ if (HG(func_whitelist) != NULL) {
8490+ if (!zend_hash_exists(HG(func_whitelist), function_name->value.str.val, function_name->value.str.len+1)) {
8491+ zend_security_log(S_EXECUTOR, "function outside of whitelist called: %s()", function_name->value.str.val);
8492+ zend_bailout();
8493+ }
8494+ } else if (HG(func_blacklist) != NULL) {
8495+ if (zend_hash_exists(HG(func_blacklist), function_name->value.str.val, function_name->value.str.len+1)) {
8496+ zend_security_log(S_EXECUTOR, "function within blacklist called: %s()", function_name->value.str.val);
8497+ zend_bailout();
8498+ }
8499+ }
8500+ }
8501+#endif
8502+
8503 zval_dtor(&tmp);
8504 EX(fbc) = function;
8505 overloaded_function_call_cont:
8506@@ -1649,6 +1705,35 @@
8507 if (zend_hash_find(EG(function_table), fname->value.str.val, fname->value.str.len+1, (void **) &EX(function_state).function)==FAILURE) {
8508 zend_error(E_ERROR, "Unknown function: %s()", fname->value.str.val);
8509 }
8510+#if HARDENING_PATCH
8511+ if (EX(function_state).function->type==ZEND_INTERNAL_FUNCTION) {
8512+ if (EG(in_code_type) == ZEND_EVAL_CODE) {
8513+ if (HG(eval_whitelist) != NULL) {
8514+ if (!zend_hash_exists(HG(eval_whitelist), fname->value.str.val, fname->value.str.len+1)) {
8515+ zend_security_log(S_EXECUTOR, "function outside of eval whitelist called: %s()", fname->value.str.val);
8516+ zend_bailout();
8517+ }
8518+ } else if (HG(eval_blacklist) != NULL) {
8519+ if (zend_hash_exists(HG(eval_blacklist), fname->value.str.val, fname->value.str.len+1)) {
8520+ zend_security_log(S_EXECUTOR, "function within eval blacklist called: %s()", fname->value.str.val);
8521+ zend_bailout();
8522+ }
8523+ }
8524+ }
8525+
8526+ if (HG(func_whitelist) != NULL) {
8527+ if (!zend_hash_exists(HG(func_whitelist), fname->value.str.val, fname->value.str.len+1)) {
8528+ zend_security_log(S_EXECUTOR, "function outside of whitelist called: %s()", fname->value.str.val);
8529+ zend_bailout();
8530+ }
8531+ } else if (HG(func_blacklist) != NULL) {
8532+ if (zend_hash_exists(HG(func_blacklist), fname->value.str.val, fname->value.str.len+1)) {
8533+ zend_security_log(S_EXECUTOR, "function within blacklist called: %s()", fname->value.str.val);
8534+ zend_bailout();
8535+ }
8536+ }
8537+ }
8538+#endif
8539 FREE_OP(EX(Ts), &EX(opline)->op1, EG(free_op1));
8540 zend_ptr_stack_n_push(&EG(arg_types_stack), 2, EX(object).ptr, EX(ce));
8541 EX(object).ptr = NULL;
8542@@ -1821,6 +1906,7 @@
8543 efree(EX(Ts));
8544 }
8545 EG(in_execution) = EX(original_in_execution);
8546+ EG(in_code_type) = EX(original_in_code_type);
8547 EG(current_execute_data) = EX(prev_execute_data);
8548 return;
8549 }
8550@@ -2210,7 +2296,12 @@
8551 int dummy = 1;
8552 zend_file_handle file_handle = {0};
8553
8554+#if HARDENING_PATCH_INC_PROTECT
8555+ if (zend_is_valid_include(inc_filename)
8556+ && zend_open(inc_filename->value.str.val, &file_handle) == SUCCESS
8557+#else
8558 if (zend_open(inc_filename->value.str.val, &file_handle) == SUCCESS
8559+#endif
8560 && ZEND_IS_VALID_FILE_HANDLE(&file_handle)) {
8561
8562 file_handle.filename = inc_filename->value.str.val;
8563@@ -2239,6 +2330,11 @@
8564 break;
8565 case ZEND_INCLUDE:
8566 case ZEND_REQUIRE:
8567+#if HARDENING_PATCH_INC_PROTECT
8568+ if (!zend_is_valid_include(inc_filename)) {
8569+ break;
8570+ }
8571+#endif
8572 new_op_array = compile_filename(EX(opline)->op2.u.constant.value.lval, inc_filename TSRMLS_CC);
8573 break;
8574 case ZEND_EVAL: {
8575@@ -2381,7 +2477,7 @@
8576 if (EX(opline)->extended_value) {
8577 array_ptr_ptr = get_zval_ptr_ptr(&EX(opline)->op1, EX(Ts), BP_VAR_R);
8578 if (array_ptr_ptr == NULL) {
8579- MAKE_STD_ZVAL(array_ptr);
8580+ ALLOC_INIT_ZVAL(array_ptr);
8581 } else {
8582 SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
8583 array_ptr = *array_ptr_ptr;
8584diff -Nura php-4.4.2/Zend/zend_execute_globals.h hardening-patch-4.4.2-0.4.15/Zend/zend_execute_globals.h
8585--- php-4.4.2/Zend/zend_execute_globals.h 2006-01-01 14:46:49.000000000 +0100
8586+++ hardening-patch-4.4.2-0.4.15/Zend/zend_execute_globals.h 2006-09-05 20:30:33.000000000 +0200
8587@@ -60,6 +60,8 @@
8588 object_info object;
8589 temp_variable *Ts;
8590 zend_bool original_in_execution;
8591+ zend_uint original_in_code_type;
8592+ zend_uint execute_depth;
8593 zend_op_array *op_array;
8594 struct _zend_execute_data *prev_execute_data;
8595 } zend_execute_data;
8596diff -Nura php-4.4.2/Zend/zend_extensions.c hardening-patch-4.4.2-0.4.15/Zend/zend_extensions.c
8597--- php-4.4.2/Zend/zend_extensions.c 2006-01-01 14:46:49.000000000 +0100
8598+++ hardening-patch-4.4.2-0.4.15/Zend/zend_extensions.c 2006-09-05 20:30:33.000000000 +0200
8599@@ -54,23 +54,44 @@
8600 return FAILURE;
8601 }
8602
8603+ /* check if module is compiled against Hardening-Patch */
8604+ if (extension_version_info->zend_extension_api_no < 1000000000) {
8605+ fprintf(stderr, "%s is not compiled with Hardening-Patch.\n"
8606+ "The Hardening-Patch version %d is installed.\n\n",
8607+ new_extension->name,
8608+ HARDENING_PATCH_ZEND_EXTENSION_API_NO);
8609+ DL_UNLOAD(handle);
8610+ return FAILURE;
8611+ }
8612+
8613+
8614+ /* check if module is compiled against correct Hardening-Patch version */
8615+ if (extension_version_info->zend_extension_api_no != HARDENING_PATCH_ZEND_EXTENSION_API_NO) {
8616+ fprintf(stderr, "%s requires Hardening-Patch version %d.\n"
8617+ "The Hardening-Patch version %d is installed.\n\n",
8618+ new_extension->name,
8619+ extension_version_info->zend_extension_api_no,
8620+ HARDENING_PATCH_ZEND_EXTENSION_API_NO);
8621+ DL_UNLOAD(handle);
8622+ return FAILURE;
8623+ }
8624
8625 /* allow extension to proclaim compatibility with any Zend version */
8626- if (extension_version_info->zend_extension_api_no != ZEND_EXTENSION_API_NO &&(!new_extension->api_no_check || new_extension->api_no_check(ZEND_EXTENSION_API_NO) != SUCCESS)) {
8627- if (extension_version_info->zend_extension_api_no > ZEND_EXTENSION_API_NO) {
8628+ if (extension_version_info->real_zend_extension_api_no != ZEND_EXTENSION_API_NO &&(!new_extension->api_no_check || new_extension->api_no_check(ZEND_EXTENSION_API_NO) != SUCCESS)) {
8629+ if (extension_version_info->real_zend_extension_api_no > ZEND_EXTENSION_API_NO) {
8630 fprintf(stderr, "%s requires Zend Engine API version %d.\n"
8631 "The Zend Engine API version %d which is installed, is outdated.\n\n",
8632 new_extension->name,
8633- extension_version_info->zend_extension_api_no,
8634+ extension_version_info->real_zend_extension_api_no,
8635 ZEND_EXTENSION_API_NO);
8636 DL_UNLOAD(handle);
8637 return FAILURE;
8638- } else if (extension_version_info->zend_extension_api_no < ZEND_EXTENSION_API_NO) {
8639+ } else if (extension_version_info->real_zend_extension_api_no < ZEND_EXTENSION_API_NO) {
8640 fprintf(stderr, "%s requires Zend Engine API version %d.\n"
8641 "The Zend Engine API version %d which is installed, is newer.\n"
8642 "Contact %s at %s for a later version of %s.\n\n",
8643 new_extension->name,
8644- extension_version_info->zend_extension_api_no,
8645+ extension_version_info->real_zend_extension_api_no,
8646 ZEND_EXTENSION_API_NO,
8647 new_extension->author,
8648 new_extension->URL,
8649diff -Nura php-4.4.2/Zend/zend_extensions.h hardening-patch-4.4.2-0.4.15/Zend/zend_extensions.h
8650--- php-4.4.2/Zend/zend_extensions.h 2006-01-01 14:46:49.000000000 +0100
8651+++ hardening-patch-4.4.2-0.4.15/Zend/zend_extensions.h 2006-09-05 20:30:33.000000000 +0200
8652@@ -23,6 +23,9 @@
8653
8654 #include "zend_compile.h"
8655
8656+/* Create own API version number for Hardening-Patch */
8657+
8658+#define HARDENING_PATCH_ZEND_EXTENSION_API_NO 1001050805
8659 #define ZEND_EXTENSION_API_NO 20050606
8660
8661 typedef struct _zend_extension_version_info {
8662@@ -30,6 +33,7 @@
8663 char *required_zend_version;
8664 unsigned char thread_safe;
8665 unsigned char debug;
8666+ int real_zend_extension_api_no;
8667 } zend_extension_version_info;
8668
8669
8670@@ -96,7 +100,7 @@
8671
8672
8673 #define ZEND_EXTENSION() \
8674- ZEND_EXT_API zend_extension_version_info extension_version_info = { ZEND_EXTENSION_API_NO, ZEND_VERSION, ZTS_V, ZEND_DEBUG }
8675+ ZEND_EXT_API zend_extension_version_info extension_version_info = { HARDENING_PATCH_ZEND_EXTENSION_API_NO, ZEND_VERSION, ZTS_V, ZEND_DEBUG, ZEND_EXTENSION_API_NO }
8676
8677 #define STANDARD_ZEND_EXTENSION_PROPERTIES NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, -1
8678 #define COMPAT_ZEND_EXTENSION_PROPERTIES NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, -1
8679diff -Nura php-4.4.2/Zend/zend_globals.h hardening-patch-4.4.2-0.4.15/Zend/zend_globals.h
8680--- php-4.4.2/Zend/zend_globals.h 2006-01-01 14:46:49.000000000 +0100
8681+++ hardening-patch-4.4.2-0.4.15/Zend/zend_globals.h 2006-09-05 20:30:33.000000000 +0200
8682@@ -163,6 +163,16 @@
8683
8684 int error_reporting;
8685 int orig_error_reporting;
8686+#if HARDENING_PATCH
8687+ int hphp_log_syslog;
8688+ int hphp_log_syslog_facility;
8689+ int hphp_log_syslog_priority;
8690+ int hphp_log_sapi;
8691+ int hphp_log_script;
8692+ char *hphp_log_scriptname;
8693+ zend_bool hphp_log_use_x_forwarded_for;
8694+ long hphp_executor_max_depth;
8695+#endif
8696 int exit_status;
8697
8698 zend_op_array *active_op_array;
8699@@ -176,6 +186,7 @@
8700 int ticks_count;
8701
8702 zend_bool in_execution;
8703+ zend_uint in_code_type;
8704 zend_bool bailout_set;
8705 zend_bool full_tables_cleanup;
8706
8707diff -Nura php-4.4.2/Zend/zend.h hardening-patch-4.4.2-0.4.15/Zend/zend.h
8708--- php-4.4.2/Zend/zend.h 2006-01-01 14:46:49.000000000 +0100
8709+++ hardening-patch-4.4.2-0.4.15/Zend/zend.h 2006-09-05 20:30:33.000000000 +0200
8710@@ -274,9 +274,10 @@
8711 struct _zval_struct {
8712 /* Variable information */
8713 zvalue_value value; /* value */
8714+ zend_uint refcount;
8715+ zend_ushort flags;
8716 zend_uchar type; /* active type */
8717 zend_uchar is_ref;
8718- zend_ushort refcount;
8719 };
8720
8721
8722@@ -337,6 +338,12 @@
8723 void (*ticks_function)(int ticks);
8724 void (*on_timeout)(int seconds TSRMLS_DC);
8725 zend_bool (*open_function)(const char *filename, struct _zend_file_handle *);
8726+#if HARDENING_PATCH
8727+ void (*security_log_function)(int loglevel, char *fmt, ...);
8728+#endif
8729+#if HARDENING_PATCH_INC_PROTECT
8730+ int (*is_valid_include)(zval *z);
8731+#endif
8732 } zend_utility_functions;
8733
8734
8735@@ -468,7 +475,16 @@
8736 extern ZEND_API void (*zend_ticks_function)(int ticks);
8737 extern ZEND_API void (*zend_error_cb)(int type, const char *error_filename, const uint error_lineno, const char *format, va_list args) ZEND_ATTRIBUTE_PTR_FORMAT(printf, 4, 0);
8738 extern void (*zend_on_timeout)(int seconds TSRMLS_DC);
8739+#if HARDENING_PATCH
8740+extern ZEND_API void (*zend_security_log)(int loglevel, char *fmt, ...);
8741+#endif
8742+#if HARDENING_PATCH_INC_PROTECT
8743+extern ZEND_API int (*zend_is_valid_include)(zval *z);
8744+#endif
8745
8746+#if HARDENING_PATCH_MM_PROTECT || HARDENING_PATCH_LL_PROTECT || HARDENING_PATCH_HASH_PROTECT
8747+ZEND_API unsigned int zend_canary(void);
8748+#endif
8749
8750 ZEND_API void zend_error(int type, const char *format, ...) ZEND_ATTRIBUTE_PTR_FORMAT(printf, 2, 3);
8751
8752@@ -575,6 +591,11 @@
8753
8754 #define ZEND_MAX_RESERVED_RESOURCES 4
8755
8756+#if HARDENING_PATCH
8757+#include "hardened_globals.h"
8758+#include "php_syslog.h"
8759+#endif
8760+
8761 #endif /* ZEND_H */
8762
8763 /*
8764diff -Nura php-4.4.2/Zend/zend_hash.c hardening-patch-4.4.2-0.4.15/Zend/zend_hash.c
8765--- php-4.4.2/Zend/zend_hash.c 2006-01-01 14:46:49.000000000 +0100
8766+++ hardening-patch-4.4.2-0.4.15/Zend/zend_hash.c 2006-09-05 20:30:33.000000000 +0200
8767@@ -26,6 +26,17 @@
8768 # include <stdlib.h>
8769 #endif
8770
8771+#if HARDENING_PATCH_HASH_PROTECT
8772+ unsigned int zend_hash_canary = 0x1234567;
8773+ zend_bool zend_hash_canary_inited = 0;
8774+#endif
8775+
8776+#define CHECK_HASH_CANARY(hash) \
8777+ if (zend_hash_canary != (hash)->canary) { \
8778+ zend_security_log(S_MEMORY, "Zend HashTable canary was overwritten"); \
8779+ exit(1); \
8780+ }
8781+
8782 #define HANDLE_NUMERIC(key, length, func) { \
8783 register char *tmp=key; \
8784 \
8785@@ -175,6 +186,9 @@
8786 {
8787 uint i = 3;
8788 Bucket **tmp;
8789+#if HARDENING_PATCH_HASH_PROTECT
8790+ TSRMLS_FETCH();
8791+#endif
8792
8793 SET_INCONSISTENT(HT_OK);
8794
8795@@ -184,6 +198,13 @@
8796
8797 ht->nTableSize = 1 << i;
8798 ht->nTableMask = ht->nTableSize - 1;
8799+#if HARDENING_PATCH_HASH_PROTECT
8800+ if (zend_hash_canary_inited==0) {
8801+ zend_hash_canary = zend_canary();
8802+ zend_hash_canary_inited = 1;
8803+ }
8804+ ht->canary = zend_hash_canary;
8805+#endif
8806 ht->pDestructor = pDestructor;
8807 ht->pListHead = NULL;
8808 ht->pListTail = NULL;
8809@@ -259,6 +280,9 @@
8810 }
8811 #endif
8812 if (ht->pDestructor) {
8813+#if HARDENING_PATCH_HASH_PROTECT
8814+ CHECK_HASH_CANARY(ht);
8815+#endif
8816 ht->pDestructor(p->pData);
8817 }
8818 UPDATE_DATA(ht, p, pData, nDataSize);
8819@@ -327,6 +351,9 @@
8820 }
8821 #endif
8822 if (ht->pDestructor) {
8823+#if HARDENING_PATCH_HASH_PROTECT
8824+ CHECK_HASH_CANARY(ht);
8825+#endif
8826 ht->pDestructor(p->pData);
8827 }
8828 UPDATE_DATA(ht, p, pData, nDataSize);
8829@@ -402,6 +429,9 @@
8830 }
8831 #endif
8832 if (ht->pDestructor) {
8833+#if HARDENING_PATCH_HASH_PROTECT
8834+ CHECK_HASH_CANARY(ht);
8835+#endif
8836 ht->pDestructor(p->pData);
8837 }
8838 UPDATE_DATA(ht, p, pData, nDataSize);
8839@@ -450,7 +480,7 @@
8840 IS_CONSISTENT(ht);
8841
8842 if ((ht->nTableSize << 1) > 0) { /* Let's double the table size */
8843- t = (Bucket **) perealloc_recoverable(ht->arBuckets, (ht->nTableSize << 1) * sizeof(Bucket *), ht->persistent);
8844+ t = (Bucket **) perealloc(ht->arBuckets, (ht->nTableSize << 1) * sizeof(Bucket *), ht->persistent);
8845 if (t) {
8846 HANDLE_BLOCK_INTERRUPTIONS();
8847 ht->arBuckets = t;
8848@@ -460,6 +490,7 @@
8849 HANDLE_UNBLOCK_INTERRUPTIONS();
8850 return SUCCESS;
8851 }
8852+ zend_error(E_ERROR, "zend_hash_do_resize - out of memory");
8853 return FAILURE;
8854 }
8855 return SUCCESS;
8856@@ -491,15 +522,17 @@
8857 IS_CONSISTENT(ht);
8858
8859 if (flag == HASH_DEL_KEY) {
8860- HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_del_key_or_index(ht, arKey, nKeyLength, idx, HASH_DEL_INDEX));
8861+ HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_del_key_or_index(ht, NULL, 0, idx, HASH_DEL_INDEX));
8862 h = zend_inline_hash_func(arKey, nKeyLength);
8863 }
8864 nIndex = h & ht->nTableMask;
8865
8866 p = ht->arBuckets[nIndex];
8867 while (p != NULL) {
8868- if ((p->h == h) && ((p->nKeyLength == 0) || /* Numeric index */
8869- ((p->nKeyLength == nKeyLength) && (!memcmp(p->arKey, arKey, nKeyLength))))) {
8870+ if ((p->h == h)
8871+ && (p->nKeyLength == nKeyLength)
8872+ && ((p->nKeyLength == 0) /* Numeric index (short circuits the memcmp() check) */
8873+ || !memcmp(p->arKey, arKey, nKeyLength))) { /* String index */
8874 HANDLE_BLOCK_INTERRUPTIONS();
8875 if (p == ht->arBuckets[nIndex]) {
8876 ht->arBuckets[nIndex] = p->pNext;
8877@@ -524,6 +557,9 @@
8878 ht->pInternalPointer = p->pListNext;
8879 }
8880 if (ht->pDestructor) {
8881+#if HARDENING_PATCH_HASH_PROTECT
8882+ CHECK_HASH_CANARY(ht);
8883+#endif
8884 ht->pDestructor(p->pData);
8885 }
8886 if (!p->pDataPtr) {
8887@@ -553,6 +589,9 @@
8888 q = p;
8889 p = p->pListNext;
8890 if (ht->pDestructor) {
8891+#if HARDENING_PATCH_HASH_PROTECT
8892+ CHECK_HASH_CANARY(ht);
8893+#endif
8894 ht->pDestructor(q->pData);
8895 }
8896 if (!q->pDataPtr && q->pData) {
8897@@ -579,6 +618,9 @@
8898 q = p;
8899 p = p->pListNext;
8900 if (ht->pDestructor) {
8901+#if HARDENING_PATCH_HASH_PROTECT
8902+ CHECK_HASH_CANARY(ht);
8903+#endif
8904 ht->pDestructor(q->pData);
8905 }
8906 if (!q->pDataPtr && q->pData) {
8907@@ -608,6 +650,9 @@
8908 HANDLE_BLOCK_INTERRUPTIONS();
8909
8910 if (ht->pDestructor) {
8911+#if HARDENING_PATCH_HASH_PROTECT
8912+ CHECK_HASH_CANARY(ht);
8913+#endif
8914 ht->pDestructor(p->pData);
8915 }
8916 if (!p->pDataPtr) {
8917diff -Nura php-4.4.2/Zend/zend_hash.h hardening-patch-4.4.2-0.4.15/Zend/zend_hash.h
8918--- php-4.4.2/Zend/zend_hash.h 2006-01-01 14:46:49.000000000 +0100
8919+++ hardening-patch-4.4.2-0.4.15/Zend/zend_hash.h 2006-09-05 20:30:33.000000000 +0200
8920@@ -54,6 +54,9 @@
8921 } Bucket;
8922
8923 typedef struct _hashtable {
8924+#if HARDENING_PATCH_HASH_PROTECT
8925+ unsigned int canary;
8926+#endif
8927 uint nTableSize;
8928 uint nTableMask;
8929 uint nNumOfElements;
8930diff -Nura php-4.4.2/Zend/zend_ini.c hardening-patch-4.4.2-0.4.15/Zend/zend_ini.c
8931--- php-4.4.2/Zend/zend_ini.c 2005-09-02 23:09:03.000000000 +0200
8932+++ hardening-patch-4.4.2-0.4.15/Zend/zend_ini.c 2006-09-07 19:14:18.000000000 +0200
8933@@ -256,7 +256,8 @@
8934 zend_ini_entry *ini_entry;
8935 TSRMLS_FETCH();
8936
8937- if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry)==FAILURE) {
8938+ if (zend_hash_find(EG(ini_directives), name, name_length, (void **) &ini_entry)==FAILURE ||
8939+ (stage == ZEND_INI_STAGE_RUNTIME && (ini_entry->modifyable & ZEND_INI_USER) == 0)) {
8940 return FAILURE;
8941 }
8942
8943diff -Nura php-4.4.2/Zend/zend_ini.h hardening-patch-4.4.2-0.4.15/Zend/zend_ini.h
8944--- php-4.4.2/Zend/zend_ini.h 2005-01-09 18:00:16.000000000 +0100
8945+++ hardening-patch-4.4.2-0.4.15/Zend/zend_ini.h 2006-09-05 20:30:33.000000000 +0200
8946@@ -174,6 +174,7 @@
8947 /* Standard message handlers */
8948 BEGIN_EXTERN_C()
8949 ZEND_API ZEND_INI_MH(OnUpdateBool);
8950+#define OnUpdateLong OnUpdateInt
8951 ZEND_API ZEND_INI_MH(OnUpdateInt);
8952 ZEND_API ZEND_INI_MH(OnUpdateReal);
8953 ZEND_API ZEND_INI_MH(OnUpdateString);
8954diff -Nura php-4.4.2/Zend/zend_language_scanner.l hardening-patch-4.4.2-0.4.15/Zend/zend_language_scanner.l
8955--- php-4.4.2/Zend/zend_language_scanner.l 2006-01-01 14:46:49.000000000 +0100
8956+++ hardening-patch-4.4.2-0.4.15/Zend/zend_language_scanner.l 2006-09-05 20:30:33.000000000 +0200
8957@@ -393,6 +393,13 @@
8958 compilation_successful=0;
8959 } else {
8960 init_op_array(op_array, ZEND_USER_FUNCTION, INITIAL_OP_ARRAY_SIZE TSRMLS_CC);
8961+#if HARDENING_PATCH
8962+ if (EG(in_code_type)==ZEND_EVAL_CODE) {
8963+ op_array->created_by_eval = 1;
8964+ } else {
8965+ op_array->created_by_eval = 0;
8966+ }
8967+#endif
8968 CG(in_compilation) = 1;
8969 CG(active_op_array) = op_array;
8970 compiler_result = zendparse(TSRMLS_C);
8971diff -Nura php-4.4.2/Zend/zend_language_scanner.c hardening-patch-4.4.2-0.4.15/Zend/zend_language_scanner.c
8972--- php-4.4.2/Zend/zend_language_scanner.c 2006-01-12 19:24:28.000000000 +0100
8973+++ hardening-patch-4.4.2-0.4.15/Zend/zend_language_scanner.c 2006-09-05 20:30:33.000000000 +0200
8974@@ -3036,6 +3036,13 @@
8975 compilation_successful=0;
8976 } else {
8977 init_op_array(op_array, ZEND_USER_FUNCTION, INITIAL_OP_ARRAY_SIZE TSRMLS_CC);
8978+#if HARDENING_PATCH
8979+ if (EG(in_code_type)==ZEND_EVAL_CODE) {
8980+ op_array->created_by_eval = 1;
8981+ } else {
8982+ op_array->created_by_eval = 0;
8983+ }
8984+#endif
8985 CG(in_compilation) = 1;
8986 CG(active_op_array) = op_array;
8987 compiler_result = zendparse(TSRMLS_C);
8988diff -Nura php-4.4.2/Zend/zend_llist.c hardening-patch-4.4.2-0.4.15/Zend/zend_llist.c
8989--- php-4.4.2/Zend/zend_llist.c 2006-01-01 14:46:49.000000000 +0100
8990+++ hardening-patch-4.4.2-0.4.15/Zend/zend_llist.c 2006-09-05 20:30:33.000000000 +0200
8991@@ -21,9 +21,49 @@
8992 #include "zend.h"
8993 #include "zend_llist.h"
8994 #include "zend_qsort.h"
8995+#include "zend_globals.h"
8996+
8997+#if HARDENING_PATCH_LL_PROTECT
8998+ unsigned int zend_llist_canary_1 = 0x1234567;
8999+ unsigned int zend_llist_canary_2 = 0x1553425;
9000+ zend_bool zend_llist_canary_inited = 0;
9001+#endif
9002+
9003+#define CHECK_LIST_CANARY(list) \
9004+ if (((list)->persistent && (zend_llist_canary_1 != (list)->canary_h || zend_llist_canary_2 != (list)->canary_t)) \
9005+ ||(!(list)->persistent && (HG(canary_3) != (list)->canary_h || HG(canary_4) != (list)->canary_t))) { \
9006+ zend_security_log(S_MEMORY, "linked list canary was overwritten"); \
9007+ exit(1); \
9008+ }
9009+
9010+#define CHECK_LISTELEMENT_CANARY(elem, list) \
9011+ if (((list)->persistent && zend_llist_canary_1 != (elem)->canary)||(!(list)->persistent && HG(canary_3) != (elem)->canary)) { \
9012+ zend_security_log(S_MEMORY, "linked list element canary was overwritten"); \
9013+ exit(1); \
9014+ }
9015+
9016
9017 ZEND_API void zend_llist_init(zend_llist *l, size_t size, llist_dtor_func_t dtor, unsigned char persistent)
9018 {
9019+#if HARDENING_PATCH_LL_PROTECT
9020+ TSRMLS_FETCH();
9021+
9022+ if (persistent) {
9023+ if (!zend_llist_canary_inited) {
9024+ /* do not change order to ensure thread safety */
9025+ zend_llist_canary_1 = zend_canary();
9026+ zend_llist_canary_2 = zend_canary();
9027+ zend_llist_canary_inited = 1;
9028+ }
9029+ } else
9030+ if (!HG(ll_canary_inited)) {
9031+ HG(canary_3) = zend_canary();
9032+ HG(canary_4) = zend_canary();
9033+ HG(ll_canary_inited) = 1;
9034+ }
9035+ l->canary_h = persistent ? zend_llist_canary_1 : HG(canary_3);
9036+ l->canary_t = persistent ? zend_llist_canary_2 : HG(canary_4);
9037+#endif
9038 l->head = NULL;
9039 l->tail = NULL;
9040 l->count = 0;
9041@@ -37,6 +77,11 @@
9042 {
9043 zend_llist_element *tmp = pemalloc(sizeof(zend_llist_element)+l->size-1, l->persistent);
9044
9045+#if HARDENING_PATCH_LL_PROTECT
9046+ TSRMLS_FETCH();
9047+ CHECK_LIST_CANARY(l)
9048+ tmp->canary = l->persistent ? zend_llist_canary_1 : HG(canary_3);
9049+#endif
9050 tmp->prev = l->tail;
9051 tmp->next = NULL;
9052 if (l->tail) {
9053@@ -55,6 +100,11 @@
9054 {
9055 zend_llist_element *tmp = pemalloc(sizeof(zend_llist_element)+l->size-1, l->persistent);
9056
9057+#if HARDENING_PATCH_LL_PROTECT
9058+ TSRMLS_FETCH();
9059+ CHECK_LIST_CANARY(l)
9060+ tmp->canary = l->persistent ? zend_llist_canary_1 : HG(canary_3);
9061+#endif
9062 tmp->next = l->head;
9063 tmp->prev = NULL;
9064 if (l->head) {
9065@@ -91,10 +141,20 @@
9066 zend_llist_element *current=l->head;
9067 zend_llist_element *next;
9068
9069+#if HARDENING_PATCH_LL_PROTECT
9070+ TSRMLS_FETCH();
9071+ CHECK_LIST_CANARY(l)
9072+#endif
9073 while (current) {
9074+#if HARDENING_PATCH_LL_PROTECT
9075+ CHECK_LISTELEMENT_CANARY(current, l)
9076+#endif
9077 next = current->next;
9078 if (compare(current->data, element)) {
9079 DEL_LLIST_ELEMENT(current, l);
9080+#if HARDENING_PATCH_LL_PROTECT
9081+ current->canary = 0;
9082+#endif
9083 break;
9084 }
9085 current = next;
9086@@ -106,7 +166,14 @@
9087 {
9088 zend_llist_element *current=l->head, *next;
9089
9090+#if HARDENING_PATCH_LL_PROTECT
9091+ TSRMLS_FETCH();
9092+ CHECK_LIST_CANARY(l)
9093+#endif
9094 while (current) {
9095+#if HARDENING_PATCH_LL_PROTECT
9096+ CHECK_LISTELEMENT_CANARY(current, l)
9097+#endif
9098 next = current->next;
9099 if (l->dtor) {
9100 l->dtor(current->data);
9101@@ -131,7 +198,14 @@
9102 zend_llist_element *old_tail;
9103 void *data;
9104
9105+#if HARDENING_PATCH_LL_PROTECT
9106+ TSRMLS_FETCH();
9107+ CHECK_LIST_CANARY(l)
9108+#endif
9109 if ((old_tail = l->tail)) {
9110+#if HARDENING_PATCH_LL_PROTECT
9111+ CHECK_LISTELEMENT_CANARY(old_tail, l)
9112+#endif
9113 if (l->tail->prev) {
9114 l->tail->prev->next = NULL;
9115 }
9116@@ -157,9 +231,16 @@
9117 {
9118 zend_llist_element *ptr;
9119
9120+#if HARDENING_PATCH_LL_PROTECT
9121+ TSRMLS_FETCH();
9122+ CHECK_LIST_CANARY(src)
9123+#endif
9124 zend_llist_init(dst, src->size, src->dtor, src->persistent);
9125 ptr = src->head;
9126 while (ptr) {
9127+#if HARDENING_PATCH_LL_PROTECT
9128+ CHECK_LISTELEMENT_CANARY(ptr, src)
9129+#endif
9130 zend_llist_add_element(dst, ptr->data);
9131 ptr = ptr->next;
9132 }
9133@@ -170,11 +251,21 @@
9134 {
9135 zend_llist_element *element, *next;
9136
9137+#if HARDENING_PATCH_LL_PROTECT
9138+ TSRMLS_FETCH();
9139+ CHECK_LIST_CANARY(l)
9140+#endif
9141 element=l->head;
9142 while (element) {
9143+#if HARDENING_PATCH_LL_PROTECT
9144+ CHECK_LISTELEMENT_CANARY(element, l)
9145+#endif
9146 next = element->next;
9147 if (func(element->data)) {
9148 DEL_LLIST_ELEMENT(element, l);
9149+#if HARDENING_PATCH_LL_PROTECT
9150+ element->canary = 0;
9151+#endif
9152 }
9153 element = next;
9154 }
9155@@ -185,7 +276,13 @@
9156 {
9157 zend_llist_element *element;
9158
9159+#if HARDENING_PATCH_LL_PROTECT
9160+ CHECK_LIST_CANARY(l)
9161+#endif
9162 for (element=l->head; element; element=element->next) {
9163+#if HARDENING_PATCH_LL_PROTECT
9164+ CHECK_LISTELEMENT_CANARY(element, l)
9165+#endif
9166 func(element->data TSRMLS_CC);
9167 }
9168 }
9169@@ -197,6 +294,9 @@
9170 zend_llist_element **elements;
9171 zend_llist_element *element, **ptr;
9172
9173+#if HARDENING_PATCH_LL_PROTECT
9174+ CHECK_LIST_CANARY(l)
9175+#endif
9176 if (l->count <= 0) {
9177 return;
9178 }
9179@@ -206,6 +306,9 @@
9180 ptr = &elements[0];
9181
9182 for (element=l->head; element; element=element->next) {
9183+#if HARDENING_PATCH_LL_PROTECT
9184+ CHECK_LISTELEMENT_CANARY(element, l)
9185+#endif
9186 *ptr++ = element;
9187 }
9188
9189@@ -228,7 +331,13 @@
9190 {
9191 zend_llist_element *element;
9192
9193+#if HARDENING_PATCH_LL_PROTECT
9194+ CHECK_LIST_CANARY(l)
9195+#endif
9196 for (element=l->head; element; element=element->next) {
9197+#if HARDENING_PATCH_LL_PROTECT
9198+ CHECK_LISTELEMENT_CANARY(element, l)
9199+#endif
9200 func(element->data, arg TSRMLS_CC);
9201 }
9202 }
9203@@ -239,8 +348,14 @@
9204 zend_llist_element *element;
9205 va_list args;
9206
9207+#if HARDENING_PATCH_LL_PROTECT
9208+ CHECK_LIST_CANARY(l)
9209+#endif
9210 va_start(args, num_args);
9211 for (element=l->head; element; element=element->next) {
9212+#if HARDENING_PATCH_LL_PROTECT
9213+ CHECK_LISTELEMENT_CANARY(element, l)
9214+#endif
9215 func(element->data, num_args, args TSRMLS_CC);
9216 }
9217 va_end(args);
9218@@ -249,6 +364,10 @@
9219
9220 ZEND_API int zend_llist_count(zend_llist *l)
9221 {
9222+#if HARDENING_PATCH_LL_PROTECT
9223+ TSRMLS_FETCH();
9224+ CHECK_LIST_CANARY(l)
9225+#endif
9226 return l->count;
9227 }
9228
9229@@ -256,8 +375,15 @@
9230 {
9231 zend_llist_position *current = pos ? pos : &l->traverse_ptr;
9232
9233+#if HARDENING_PATCH_LL_PROTECT
9234+ TSRMLS_FETCH();
9235+ CHECK_LIST_CANARY(l)
9236+#endif
9237 *current = l->head;
9238 if (*current) {
9239+#if HARDENING_PATCH_LL_PROTECT
9240+ CHECK_LISTELEMENT_CANARY(*current, l)
9241+#endif
9242 return (*current)->data;
9243 } else {
9244 return NULL;
9245@@ -269,8 +395,15 @@
9246 {
9247 zend_llist_position *current = pos ? pos : &l->traverse_ptr;
9248
9249+#if HARDENING_PATCH_LL_PROTECT
9250+ TSRMLS_FETCH();
9251+ CHECK_LIST_CANARY(l)
9252+#endif
9253 *current = l->tail;
9254 if (*current) {
9255+#if HARDENING_PATCH_LL_PROTECT
9256+ CHECK_LISTELEMENT_CANARY(*current, l)
9257+#endif
9258 return (*current)->data;
9259 } else {
9260 return NULL;
9261@@ -282,9 +415,19 @@
9262 {
9263 zend_llist_position *current = pos ? pos : &l->traverse_ptr;
9264
9265+#if HARDENING_PATCH_LL_PROTECT
9266+ TSRMLS_FETCH();
9267+ CHECK_LIST_CANARY(l)
9268+#endif
9269 if (*current) {
9270+#if HARDENING_PATCH_LL_PROTECT
9271+ CHECK_LISTELEMENT_CANARY(*current, l)
9272+#endif
9273 *current = (*current)->next;
9274 if (*current) {
9275+#if HARDENING_PATCH_LL_PROTECT
9276+ CHECK_LISTELEMENT_CANARY(*current, l)
9277+#endif
9278 return (*current)->data;
9279 }
9280 }
9281@@ -296,9 +439,19 @@
9282 {
9283 zend_llist_position *current = pos ? pos : &l->traverse_ptr;
9284
9285+#if HARDENING_PATCH_LL_PROTECT
9286+ TSRMLS_FETCH();
9287+ CHECK_LIST_CANARY(l)
9288+#endif
9289 if (*current) {
9290+#if HARDENING_PATCH_LL_PROTECT
9291+ CHECK_LISTELEMENT_CANARY(*current, l)
9292+#endif
9293 *current = (*current)->prev;
9294 if (*current) {
9295+#if HARDENING_PATCH_LL_PROTECT
9296+ CHECK_LISTELEMENT_CANARY(*current, l)
9297+#endif
9298 return (*current)->data;
9299 }
9300 }
9301diff -Nura php-4.4.2/Zend/zend_llist.h hardening-patch-4.4.2-0.4.15/Zend/zend_llist.h
9302--- php-4.4.2/Zend/zend_llist.h 2006-01-01 14:46:49.000000000 +0100
9303+++ hardening-patch-4.4.2-0.4.15/Zend/zend_llist.h 2006-09-05 20:30:33.000000000 +0200
9304@@ -24,6 +24,9 @@
9305 #include <stdlib.h>
9306
9307 typedef struct _zend_llist_element {
9308+#if HARDENING_PATCH_LL_PROTECT
9309+ unsigned int canary, padding;
9310+#endif
9311 struct _zend_llist_element *next;
9312 struct _zend_llist_element *prev;
9313 char data[1]; /* Needs to always be last in the struct */
9314@@ -36,6 +39,9 @@
9315 typedef void (*llist_apply_func_t)(void * TSRMLS_DC);
9316
9317 typedef struct _zend_llist {
9318+#if HARDENING_PATCH_LL_PROTECT
9319+ unsigned int canary_h; /* head */
9320+#endif
9321 zend_llist_element *head;
9322 zend_llist_element *tail;
9323 size_t size;
9324@@ -43,6 +49,9 @@
9325 llist_dtor_func_t dtor;
9326 unsigned char persistent;
9327 zend_llist_element *traverse_ptr;
9328+#if HARDENING_PATCH_LL_PROTECT
9329+ unsigned int canary_t; /* tail */
9330+#endif
9331 } zend_llist;
9332
9333 typedef zend_llist_element* zend_llist_position;
9334diff -Nura php-4.4.2/Zend/zend_modules.h hardening-patch-4.4.2-0.4.15/Zend/zend_modules.h
9335--- php-4.4.2/Zend/zend_modules.h 2006-01-01 14:46:49.000000000 +0100
9336+++ hardening-patch-4.4.2-0.4.15/Zend/zend_modules.h 2006-09-05 20:30:33.000000000 +0200
9337@@ -34,6 +34,7 @@
9338 ZEND_API extern unsigned char second_arg_force_ref[];
9339 ZEND_API extern unsigned char third_arg_force_ref[];
9340
9341+#define HARDENING_PATCH_ZEND_MODULE_API_NO 1001051112
9342 #define ZEND_MODULE_API_NO 20020429
9343 #ifdef ZTS
9344 #define USING_ZTS 1
9345@@ -41,9 +42,9 @@
9346 #define USING_ZTS 0
9347 #endif
9348
9349-#define STANDARD_MODULE_HEADER sizeof(zend_module_entry), ZEND_MODULE_API_NO, ZEND_DEBUG, USING_ZTS
9350+#define STANDARD_MODULE_HEADER sizeof(zend_module_entry), HARDENING_PATCH_ZEND_MODULE_API_NO, ZEND_DEBUG, USING_ZTS
9351
9352-#define STANDARD_MODULE_PROPERTIES_EX 0, 0, 0, NULL, 0
9353+#define STANDARD_MODULE_PROPERTIES_EX 0, 0, 0, NULL, 0, ZEND_MODULE_API_NO
9354
9355 #define STANDARD_MODULE_PROPERTIES \
9356 NULL, NULL, STANDARD_MODULE_PROPERTIES_EX
9357@@ -75,6 +76,7 @@
9358 unsigned char type;
9359 void *handle;
9360 int module_number;
9361+ unsigned int real_zend_api;
9362 };
9363
9364
9365diff -Nura php-4.4.2/Zend/zend_opcode.c hardening-patch-4.4.2-0.4.15/Zend/zend_opcode.c
9366--- php-4.4.2/Zend/zend_opcode.c 2006-01-01 14:46:49.000000000 +0100
9367+++ hardening-patch-4.4.2-0.4.15/Zend/zend_opcode.c 2006-09-05 20:30:33.000000000 +0200
9368@@ -88,6 +88,9 @@
9369 op_array->done_pass_two = 0;
9370
9371 op_array->start_op = NULL;
9372+#if HARDENING_PATCH
9373+ op_array->created_by_eval = 0;
9374+#endif
9375
9376 zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_op_array_ctor_handler, op_array TSRMLS_CC);
9377 }
9378diff -Nura php-4.4.2/Zend/zend_operators.c hardening-patch-4.4.2-0.4.15/Zend/zend_operators.c
9379--- php-4.4.2/Zend/zend_operators.c 2006-01-01 14:46:49.000000000 +0100
9380+++ hardening-patch-4.4.2-0.4.15/Zend/zend_operators.c 2006-09-05 20:30:33.000000000 +0200
9381@@ -1604,6 +1604,20 @@
9382 return (op->value.lval ? 1 : 0);
9383 }
9384
9385+ZEND_API char *zend_str_tolower_copy(char *dest, const char *source, unsigned int length)
9386+{
9387+ register unsigned char *str = (unsigned char*)source;
9388+ register unsigned char *result = (unsigned char*)dest;
9389+ register unsigned char *end = str + length;
9390+
9391+ while (str < end) {
9392+ *result++ = tolower((int)*str++);
9393+ }
9394+ *result = *end;
9395+
9396+ return dest;
9397+}
9398+
9399 ZEND_API void zend_str_tolower(char *str, unsigned int length)
9400 {
9401 register char *p=str, *end=p+length;
9402diff -Nura php-4.4.2/Zend/zend_operators.h hardening-patch-4.4.2-0.4.15/Zend/zend_operators.h
9403--- php-4.4.2/Zend/zend_operators.h 2006-01-01 14:46:49.000000000 +0100
9404+++ hardening-patch-4.4.2-0.4.15/Zend/zend_operators.h 2006-09-05 20:30:33.000000000 +0200
9405@@ -174,6 +174,14 @@
9406 #endif
9407
9408 ZEND_API void zend_str_tolower(char *str, unsigned int length);
9409+ZEND_API char *zend_str_tolower_copy(char *dest, const char *source, unsigned int length);
9410+
9411+static inline char *
9412+zend_str_tolower_dup(const char *source, unsigned int length)
9413+{
9414+ return zend_str_tolower_copy((char *)emalloc(length+1), source, length);
9415+}
9416+
9417 ZEND_API int zend_binary_zval_strcmp(zval *s1, zval *s2);
9418 ZEND_API int zend_binary_zval_strncmp(zval *s1, zval *s2, zval *s3);
9419 ZEND_API int zend_binary_zval_strcasecmp(zval *s1, zval *s2);