1 files changed, 36 insertions, 80 deletions

diff --git a/ifilter.c b/ifilter.c
index 8b2e8a3..dfe7c6b 100644
--- a/ifilter.c
+++ b/ifilter.c
@@ -29,6 +29,7 @@
 #include "ext/standard/info.h"
 #include "php_suhosin.h"
 #include "php_variables.h"
+#include "ext/standard/php_var.h"
 
 
 static void (*orig_register_server_variables)(zval *track_vars_array TSRMLS_DC) = NULL;
@@ -150,7 +151,6 @@ static void suhosin_server_encode(HashTable *arr, char *key, int klen)
                 
                 temp = (unsigned char *)Z_STRVAL_PP(tzval);
                 
-                t = temp;
                 for (t = temp; *t; t++) {
                         if (suhosin_is_dangerous_char[*t]) {
                                 extra += 2;
@@ -186,30 +186,29 @@ static void suhosin_server_encode(HashTable *arr, char *key, int klen)
  */
 void suhosin_register_server_variables(zval *track_vars_array TSRMLS_DC)
 {
-        HashTable *svars;
-        int retval, failure=0;
-        
-                orig_register_server_variables(track_vars_array TSRMLS_CC);
+        HashTable *svars;
+        int retval = 0, failure = 0;
 
-        svars = Z_ARRVAL_P(track_vars_array);
-        
+        orig_register_server_variables(track_vars_array TSRMLS_CC);
+
+        svars = Z_ARRVAL_P(track_vars_array);
         if (!SUHOSIN_G(simulation)) {
-                retval = zend_hash_del(svars, "HTTP_GET_VARS", sizeof("HTTP_GET_VARS"));
-                if (retval == SUCCESS) failure = 1;
-                retval = zend_hash_del(svars, "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"));
-                if (retval == SUCCESS) failure = 1;
-                retval = zend_hash_del(svars, "HTTP_COOKIE_VARS", sizeof("HTTP_COOKIE_VARS"));
-                if (retval == SUCCESS) failure = 1;
-                retval = zend_hash_del(svars, "HTTP_ENV_VARS", sizeof("HTTP_ENV_VARS"));
-                if (retval == SUCCESS) failure = 1;
-                retval = zend_hash_del(svars, "HTTP_SERVER_VARS", sizeof("HTTP_SERVER_VARS"));
-                if (retval == SUCCESS) failure = 1;
-                retval = zend_hash_del(svars, "HTTP_SESSION_VARS", sizeof("HTTP_SESSION_VARS"));
-                if (retval == SUCCESS) failure = 1;
-                retval = zend_hash_del(svars, "HTTP_POST_FILES", sizeof("HTTP_POST_FILES"));
-                if (retval == SUCCESS) failure = 1;
-                retval = zend_hash_del(svars, "HTTP_RAW_POST_DATA", sizeof("HTTP_RAW_POST_DATA"));
-                if (retval == SUCCESS) failure = 1;
+                retval = zend_hash_del(svars, "HTTP_GET_VARS", sizeof("HTTP_GET_VARS"));
+                if (retval == SUCCESS) failure = 1;
+                retval = zend_hash_del(svars, "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"));
+                if (retval == SUCCESS) failure = 1;
+                retval = zend_hash_del(svars, "HTTP_COOKIE_VARS", sizeof("HTTP_COOKIE_VARS"));
+                if (retval == SUCCESS) failure = 1;
+                retval = zend_hash_del(svars, "HTTP_ENV_VARS", sizeof("HTTP_ENV_VARS"));
+                if (retval == SUCCESS) failure = 1;
+                retval = zend_hash_del(svars, "HTTP_SERVER_VARS", sizeof("HTTP_SERVER_VARS"));
+                if (retval == SUCCESS) failure = 1;
+                retval = zend_hash_del(svars, "HTTP_SESSION_VARS", sizeof("HTTP_SESSION_VARS"));
+                if (retval == SUCCESS) failure = 1;
+                retval = zend_hash_del(svars, "HTTP_POST_FILES", sizeof("HTTP_POST_FILES"));
+                if (retval == SUCCESS) failure = 1;
+                retval = zend_hash_del(svars, "HTTP_RAW_POST_DATA", sizeof("HTTP_RAW_POST_DATA"));
+                if (retval == SUCCESS) failure = 1;
         } else {
                 retval = zend_hash_exists(svars, "HTTP_GET_VARS", sizeof("HTTP_GET_VARS"));
                 retval+= zend_hash_exists(svars, "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"));
@@ -221,19 +220,19 @@ void suhosin_register_server_variables(zval *track_vars_array TSRMLS_DC)
                 retval+= zend_hash_exists(svars, "HTTP_RAW_POST_DATA", sizeof("HTTP_RAW_POST_DATA"));
                 if (retval > 0) failure = 1;
         }
-        
-        if (failure) {
-                suhosin_log(S_VARS, "Attacker tried to overwrite a superglobal through a HTTP header");
-        }
+
+        if (failure) {
+                suhosin_log(S_VARS, "Attacker tried to overwrite a superglobal through a HTTP header");
+        }
         
         if (SUHOSIN_G(raw_cookie)) {
-        zval *z;
-        MAKE_STD_ZVAL(z);
+                zval *z;
+                MAKE_STD_ZVAL(z);
                 ZVAL_STRING(z, SUHOSIN_G(raw_cookie), 1);
                 zend_hash_add(svars, "RAW_HTTP_COOKIE", sizeof("RAW_HTTP_COOKIE"), (void **)&z, sizeof(zval *), NULL);
-    }
-    if (SUHOSIN_G(decrypted_cookie)) {
-        zval *z;
+        }
+        if (SUHOSIN_G(decrypted_cookie)) {
+                zval *z;
                 MAKE_STD_ZVAL(z);
                 ZVAL_STRING(z, SUHOSIN_G(decrypted_cookie), 0);
                 zend_hash_update(svars, "HTTP_COOKIE", sizeof("HTTP_COOKIE"), (void **)&z, sizeof(zval *), NULL);
@@ -629,47 +628,11 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, unsigned int v
         
         /* Drop this variable if it is one of GLOBALS, _GET, _POST, ... */
         /* This is to protect several silly scripts that do globalizing themself */
-        
-        switch (var_len) {
-            case 18:
-                if (memcmp(var, "HTTP_RAW_POST_DATA", 18)==0) goto protected_varname;
-                break;
-            case 17:
-                if (memcmp(var, "HTTP_SESSION_VARS", 17)==0) goto protected_varname;
-                break;
-            case 16:
-                if (memcmp(var, "HTTP_SERVER_VARS", 16)==0) goto protected_varname;
-                if (memcmp(var, "HTTP_COOKIE_VARS", 16)==0) goto protected_varname;
-                break;
-            case 15:
-                if (memcmp(var, "HTTP_POST_FILES", 15)==0) goto protected_varname;
-                break;
-            case 14:
-                if (memcmp(var, "HTTP_POST_VARS", 14)==0) goto protected_varname;
-                break;
-            case 13:
-                if (memcmp(var, "HTTP_GET_VARS", 13)==0) goto protected_varname;
-                if (memcmp(var, "HTTP_ENV_VARS", 13)==0) goto protected_varname;
-                break;
-            case 8:
-                if (memcmp(var, "_SESSION", 8)==0) goto protected_varname;
-                if (memcmp(var, "_REQUEST", 8)==0) goto protected_varname;
-                break;
-            case 7:
-                if (memcmp(var, "GLOBALS", 7)==0) goto protected_varname;
-                if (memcmp(var, "_COOKIE", 7)==0) goto protected_varname;
-                if (memcmp(var, "_SERVER", 7)==0) goto protected_varname;
-                break;
-            case 6:
-                if (memcmp(var, "_FILES", 6)==0) goto protected_varname;
-                break;
-            case 5:
-                if (memcmp(var, "_POST", 5)==0) goto protected_varname;
-                break;
-            case 4:
-                if (memcmp(var, "_ENV", 4)==0) goto protected_varname;
-                if (memcmp(var, "_GET", 4)==0) goto protected_varname;
-                break;
+        if (suhosin_is_protected_varname(var, var_len)) {
+                suhosin_log(S_VARS, "tried to register forbidden variable '%s' through %s variables", var, arg == PARSE_GET ? "GET" : arg == PARSE_POST ? "POST" : "COOKIE");
+                if (!SUHOSIN_G(simulation)) {
+                        return 0;
+                }
         }
 
         /* Okay let PHP register this variable */
@@ -691,13 +654,6 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, unsigned int v
         }
 
         return 1;
-protected_varname:
-        suhosin_log(S_VARS, "tried to register forbidden variable '%s' through %s variables", var, arg == PARSE_GET ? "GET" : arg == PARSE_POST ? "POST" : "COOKIE");
-        if (!SUHOSIN_G(simulation)) {
-                return 0;
-        } else {
-                return 1;
-        }
 }
 /* }}} */