summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--execute_ih.c110
1 files changed, 55 insertions, 55 deletions
diff --git a/execute_ih.c b/execute_ih.c
index ff35a34..38fb25e 100644
--- a/execute_ih.c
+++ b/execute_ih.c
@@ -28,7 +28,7 @@ S7_IH_FUNCTION(preg_replace)
28 if (Z_TYPE_P(regex) != IS_ARRAY) { 28 if (Z_TYPE_P(regex) != IS_ARRAY) {
29 convert_to_string_ex(regex); 29 convert_to_string_ex(regex);
30 // regex is string 30 // regex is string
31 31
32 if (strlen(Z_STRVAL_P(regex)) != Z_STRLEN_P(regex)) { 32 if (strlen(Z_STRVAL_P(regex)) != Z_STRLEN_P(regex)) {
33 suhosin_log(S_EXECUTOR, "string termination attack on first preg_replace parameter detected"); 33 suhosin_log(S_EXECUTOR, "string termination attack on first preg_replace parameter detected");
34 if (!SUHOSIN7_G(simulation)) { 34 if (!SUHOSIN7_G(simulation)) {
@@ -38,7 +38,7 @@ S7_IH_FUNCTION(preg_replace)
38 } 38 }
39 } else { 39 } else {
40 // regex is array 40 // regex is array
41 41
42 /* For each entry in the regex array, get the entry */ 42 /* For each entry in the regex array, get the entry */
43 zval *regex_entry; 43 zval *regex_entry;
44 ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(regex), regex_entry) { 44 ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(regex), regex_entry) {
@@ -70,7 +70,7 @@ S7_IH_FUNCTION(symlink)
70 if (SUHOSIN7_G(executor_allow_symlink)) { 70 if (SUHOSIN7_G(executor_allow_symlink)) {
71 return SUCCESS; 71 return SUCCESS;
72 } 72 }
73 73
74 if (PG(open_basedir) && PG(open_basedir)[0]) { 74 if (PG(open_basedir) && PG(open_basedir)[0]) {
75 suhosin_log(S_EXECUTOR, "symlink called during open_basedir"); 75 suhosin_log(S_EXECUTOR, "symlink called during open_basedir");
76 if (!SUHOSIN7_G(simulation)) { 76 if (!SUHOSIN7_G(simulation)) {
@@ -78,7 +78,7 @@ S7_IH_FUNCTION(symlink)
78 return FAILURE; 78 return FAILURE;
79 } 79 }
80 } 80 }
81 81
82 return SUCCESS; 82 return SUCCESS;
83} 83}
84 84
@@ -86,7 +86,7 @@ S7_IH_FUNCTION(function_exists)
86{ 86{
87 zend_string *name; 87 zend_string *name;
88 zend_string *lcname; 88 zend_string *lcname;
89 89
90#ifndef FAST_ZPP 90#ifndef FAST_ZPP
91 if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) { 91 if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
92 return FAILURE; 92 return FAILURE;
@@ -114,7 +114,7 @@ S7_IH_FUNCTION(function_exists)
114 zend_bool retval = (func && (func->type != ZEND_INTERNAL_FUNCTION || 114 zend_bool retval = (func && (func->type != ZEND_INTERNAL_FUNCTION ||
115 func->internal_function.handler != zif_display_disabled_function)); 115 func->internal_function.handler != zif_display_disabled_function));
116 if (retval == 0) { 116 if (retval == 0) {
117 goto function_exists_return; 117 goto ret;
118 } 118 }
119 119
120 /* Now check if function is forbidden by Suhosin */ 120 /* Now check if function is forbidden by Suhosin */
@@ -122,29 +122,29 @@ S7_IH_FUNCTION(function_exists)
122 if (SUHOSIN7_G(eval_whitelist) != NULL) { 122 if (SUHOSIN7_G(eval_whitelist) != NULL) {
123 if (!zend_hash_exists(SUHOSIN7_G(eval_whitelist), lcname)) { 123 if (!zend_hash_exists(SUHOSIN7_G(eval_whitelist), lcname)) {
124 retval = 0; 124 retval = 0;
125 goto function_exists_return; 125 goto ret;
126 } 126 }
127 } else if (SUHOSIN7_G(eval_blacklist) != NULL) { 127 } else if (SUHOSIN7_G(eval_blacklist) != NULL) {
128 if (zend_hash_exists(SUHOSIN7_G(eval_blacklist), lcname)) { 128 if (zend_hash_exists(SUHOSIN7_G(eval_blacklist), lcname)) {
129 retval = 0; 129 retval = 0;
130 goto function_exists_return; 130 goto ret;
131 } 131 }
132 } 132 }
133 } 133 }
134 134
135 if (SUHOSIN7_G(func_whitelist) != NULL) { 135 if (SUHOSIN7_G(func_whitelist) != NULL) {
136 if (!zend_hash_exists(SUHOSIN7_G(func_whitelist), lcname)) { 136 if (!zend_hash_exists(SUHOSIN7_G(func_whitelist), lcname)) {
137 retval = 0; 137 retval = 0;
138 goto function_exists_return; 138 goto ret;
139 } 139 }
140 } else if (SUHOSIN7_G(func_blacklist) != NULL) { 140 } else if (SUHOSIN7_G(func_blacklist) != NULL) {
141 if (zend_hash_exists(SUHOSIN7_G(func_blacklist), lcname)) { 141 if (zend_hash_exists(SUHOSIN7_G(func_blacklist), lcname)) {
142 retval = 0; 142 retval = 0;
143 goto function_exists_return; 143 goto ret;
144 } 144 }
145 } 145 }
146 146
147function_exists_return: 147ret:
148 zend_string_release(lcname); 148 zend_string_release(lcname);
149 RETVAL_BOOL(retval); 149 RETVAL_BOOL(retval);
150 return FAILURE; 150 return FAILURE;
@@ -157,11 +157,11 @@ function_exists_return:
157// char *tmp; 157// char *tmp;
158// int to_len, message_len, headers_len; 158// int to_len, message_len, headers_len;
159// int subject_len, extra_cmd_len; 159// int subject_len, extra_cmd_len;
160// 160//
161// if (SUHOSIN7_G(mailprotect) == 0) { 161// if (SUHOSIN7_G(mailprotect) == 0) {
162// return (0); 162// return (0);
163// } 163// }
164// 164//
165// if (zend_parse_parameters(ZEND_NUM_ARGS(), "sss|ss", 165// if (zend_parse_parameters(ZEND_NUM_ARGS(), "sss|ss",
166// &to, &to_len, 166// &to, &to_len,
167// &subject, &subject_len, 167// &subject, &subject_len,
@@ -172,7 +172,7 @@ function_exists_return:
172// RETVAL_FALSE; 172// RETVAL_FALSE;
173// return (1); 173// return (1);
174// } 174// }
175// 175//
176// if (headers_len > 0 && headers && 176// if (headers_len > 0 && headers &&
177// (strstr(headers, "\n\n") || strstr(headers, "\n\r\n") /* double newline */ 177// (strstr(headers, "\n\n") || strstr(headers, "\n\r\n") /* double newline */
178// || *headers == '\n' || (headers[0] == '\r' && headers[1] == '\n') /* starts with newline */ 178// || *headers == '\n' || (headers[0] == '\r' && headers[1] == '\n') /* starts with newline */
@@ -183,7 +183,7 @@ function_exists_return:
183// return (1); 183// return (1);
184// } 184// }
185// } 185// }
186// 186//
187// /* check for spam attempts with buggy webforms */ 187// /* check for spam attempts with buggy webforms */
188// if (to_len > 0 && to) { 188// if (to_len > 0 && to) {
189// do { 189// do {
@@ -201,7 +201,7 @@ function_exists_return:
201// } 201// }
202// } 202// }
203// } 203// }
204// 204//
205// if (subject_len > 0 && subject) { 205// if (subject_len > 0 && subject) {
206// do { 206// do {
207// if ((tmp = strchr(subject, '\n')) == NULL) 207// if ((tmp = strchr(subject, '\n')) == NULL)
@@ -218,7 +218,7 @@ function_exists_return:
218// } 218// }
219// } 219// }
220// } 220// }
221// 221//
222// if (SUHOSIN7_G(mailprotect) > 1) { 222// if (SUHOSIN7_G(mailprotect) > 1) {
223// /* search for to, cc or bcc headers */ 223// /* search for to, cc or bcc headers */
224// if (headers_len > 0 && headers != NULL) { 224// if (headers_len > 0 && headers != NULL) {
@@ -229,7 +229,7 @@ function_exists_return:
229// return (1); 229// return (1);
230// } 230// }
231// } 231// }
232// 232//
233// if (strncasecmp(headers, "cc:", sizeof("cc:") - 1) == 0 || suhosin_strcasestr(headers, "\ncc:")) { 233// if (strncasecmp(headers, "cc:", sizeof("cc:") - 1) == 0 || suhosin_strcasestr(headers, "\ncc:")) {
234// suhosin_log(S_MAIL, "mail() - CC: headers aren't allowed in the headers parameter."); 234// suhosin_log(S_MAIL, "mail() - CC: headers aren't allowed in the headers parameter.");
235// if (!SUHOSIN7_G(simulation)) { 235// if (!SUHOSIN7_G(simulation)) {
@@ -237,7 +237,7 @@ function_exists_return:
237// return (1); 237// return (1);
238// } 238// }
239// } 239// }
240// 240//
241// if (strncasecmp(headers, "bcc:", sizeof("bcc:") - 1) == 0 || suhosin_strcasestr(headers, "\nbcc:")) { 241// if (strncasecmp(headers, "bcc:", sizeof("bcc:") - 1) == 0 || suhosin_strcasestr(headers, "\nbcc:")) {
242// suhosin_log(S_MAIL, "mail() - BCC: headers aren't allowed in the headers parameter."); 242// suhosin_log(S_MAIL, "mail() - BCC: headers aren't allowed in the headers parameter.");
243// if (!SUHOSIN7_G(simulation)) { 243// if (!SUHOSIN7_G(simulation)) {
@@ -247,7 +247,7 @@ function_exists_return:
247// } 247// }
248// } 248// }
249// } 249// }
250// 250//
251// return (0); 251// return (0);
252// } 252// }
253 253
@@ -256,7 +256,7 @@ function_exists_return:
256// #define SQLSTATE_STRING 2 256// #define SQLSTATE_STRING 2
257// #define SQLSTATE_COMMENT 3 257// #define SQLSTATE_COMMENT 3
258// #define SQLSTATE_MLCOMMENT 4 258// #define SQLSTATE_MLCOMMENT 4
259// 259//
260// int ih_querycheck(IH_HANDLER_PARAMS) 260// int ih_querycheck(IH_HANDLER_PARAMS)
261// { 261// {
262// void **p = zend_vm_stack_top() - 1; 262// void **p = zend_vm_stack_top() - 1;
@@ -269,21 +269,21 @@ function_exists_return:
269// int state = SQLSTATE_SQL; 269// int state = SQLSTATE_SQL;
270// int cnt_union = 0, cnt_select = 0, cnt_comment = 0, cnt_opencomment = 0; 270// int cnt_union = 0, cnt_select = 0, cnt_comment = 0, cnt_opencomment = 0;
271// int mysql_extension = 0; 271// int mysql_extension = 0;
272// 272//
273// 273//
274// SDEBUG("function: %s", ih->name); 274// SDEBUG("function: %s", ih->name);
275// arg_count = (unsigned long) *p; 275// arg_count = (unsigned long) *p;
276// 276//
277// if (ht < (long) ih->arg1) { 277// if (ht < (long) ih->arg1) {
278// return (0); 278// return (0);
279// } 279// }
280// 280//
281// if ((long) ih->arg2) { 281// if ((long) ih->arg2) {
282// mysql_extension = 1; 282// mysql_extension = 1;
283// } 283// }
284// 284//
285// arg = (zval **) p - (arg_count - (long) ih->arg1 + 1); /* count from 0 */ 285// arg = (zval **) p - (arg_count - (long) ih->arg1 + 1); /* count from 0 */
286// 286//
287// backup = *arg; 287// backup = *arg;
288// if (Z_TYPE_P(backup) != IS_STRING) { 288// if (Z_TYPE_P(backup) != IS_STRING) {
289// return (0); 289// return (0);
@@ -291,10 +291,10 @@ function_exists_return:
291// len = Z_STRLEN_P(backup); 291// len = Z_STRLEN_P(backup);
292// query = Z_STRVAL_P(backup); 292// query = Z_STRVAL_P(backup);
293// SDEBUG("SQL |%s|", query); 293// SDEBUG("SQL |%s|", query);
294// 294//
295// s = query; 295// s = query;
296// e = s+len; 296// e = s+len;
297// 297//
298// while (s < e) { 298// while (s < e) {
299// switch (state) 299// switch (state)
300// { 300// {
@@ -363,7 +363,7 @@ function_exists_return:
363// break; 363// break;
364// case SQLSTATE_COMMENT: 364// case SQLSTATE_COMMENT:
365// while (s[0] && s[0] != '\n') { 365// while (s[0] && s[0] != '\n') {
366// s++; 366// s++;
367// } 367// }
368// state = SQLSTATE_SQL; 368// state = SQLSTATE_SQL;
369// break; 369// break;
@@ -381,39 +381,39 @@ function_exists_return:
381// if (state == SQLSTATE_MLCOMMENT) { 381// if (state == SQLSTATE_MLCOMMENT) {
382// cnt_opencomment = 1; 382// cnt_opencomment = 1;
383// } 383// }
384// 384//
385// if (cnt_opencomment && SUHOSIN7_G(sql_opencomment)>0) { 385// if (cnt_opencomment && SUHOSIN7_G(sql_opencomment)>0) {
386// suhosin_log(S_SQL, "Open comment in SQL query: '%*s'", len, query); 386// suhosin_log(S_SQL, "Open comment in SQL query: '%*s'", len, query);
387// if (SUHOSIN7_G(sql_opencomment)>1) { 387// if (SUHOSIN7_G(sql_opencomment)>1) {
388// suhosin_bailout(); 388// suhosin_bailout();
389// } 389// }
390// } 390// }
391// 391//
392// if (cnt_comment && SUHOSIN7_G(sql_comment)>0) { 392// if (cnt_comment && SUHOSIN7_G(sql_comment)>0) {
393// suhosin_log(S_SQL, "Comment in SQL query: '%*s'", len, query); 393// suhosin_log(S_SQL, "Comment in SQL query: '%*s'", len, query);
394// if (SUHOSIN7_G(sql_comment)>1) { 394// if (SUHOSIN7_G(sql_comment)>1) {
395// suhosin_bailout(); 395// suhosin_bailout();
396// } 396// }
397// } 397// }
398// 398//
399// if (cnt_union && SUHOSIN7_G(sql_union)>0) { 399// if (cnt_union && SUHOSIN7_G(sql_union)>0) {
400// suhosin_log(S_SQL, "UNION in SQL query: '%*s'", len, query); 400// suhosin_log(S_SQL, "UNION in SQL query: '%*s'", len, query);
401// if (SUHOSIN7_G(sql_union)>1) { 401// if (SUHOSIN7_G(sql_union)>1) {
402// suhosin_bailout(); 402// suhosin_bailout();
403// } 403// }
404// } 404// }
405// 405//
406// if (cnt_select>1 && SUHOSIN7_G(sql_mselect)>0) { 406// if (cnt_select>1 && SUHOSIN7_G(sql_mselect)>0) {
407// suhosin_log(S_SQL, "Multiple SELECT in SQL query: '%*s'", len, query); 407// suhosin_log(S_SQL, "Multiple SELECT in SQL query: '%*s'", len, query);
408// if (SUHOSIN7_G(sql_mselect)>1) { 408// if (SUHOSIN7_G(sql_mselect)>1) {
409// suhosin_bailout(); 409// suhosin_bailout();
410// } 410// }
411// } 411// }
412// 412//
413// return (0); 413// return (0);
414// } 414// }
415// 415//
416// 416//
417// int ih_fixusername(IH_HANDLER_PARAMS) 417// int ih_fixusername(IH_HANDLER_PARAMS)
418// { 418// {
419// void **p = zend_vm_stack_top() - 1; 419// void **p = zend_vm_stack_top() - 1;
@@ -422,21 +422,21 @@ function_exists_return:
422// char *prefix, *postfix, *user, *user_match, *cp; 422// char *prefix, *postfix, *user, *user_match, *cp;
423// zval *backup, *my_user; 423// zval *backup, *my_user;
424// int prefix_len, postfix_len, len; 424// int prefix_len, postfix_len, len;
425// 425//
426// SDEBUG("function (fixusername): %s", ih->name); 426// SDEBUG("function (fixusername): %s", ih->name);
427// 427//
428// prefix = SUHOSIN7_G(sql_user_prefix); 428// prefix = SUHOSIN7_G(sql_user_prefix);
429// postfix = SUHOSIN7_G(sql_user_postfix); 429// postfix = SUHOSIN7_G(sql_user_postfix);
430// user_match = SUHOSIN7_G(sql_user_match); 430// user_match = SUHOSIN7_G(sql_user_match);
431// 431//
432// arg_count = (unsigned long) *p; 432// arg_count = (unsigned long) *p;
433// 433//
434// if (ht < (long) ih->arg1) { 434// if (ht < (long) ih->arg1) {
435// return (0); 435// return (0);
436// } 436// }
437// 437//
438// arg = (zval **) p - (arg_count - (long) ih->arg1 + 1); /* count from 0 */ 438// arg = (zval **) p - (arg_count - (long) ih->arg1 + 1); /* count from 0 */
439// 439//
440// backup = *arg; 440// backup = *arg;
441// if (Z_TYPE_P(backup) != IS_STRING) { 441// if (Z_TYPE_P(backup) != IS_STRING) {
442// user = ""; 442// user = "";
@@ -445,7 +445,7 @@ function_exists_return:
445// len = Z_STRLEN_P(backup); 445// len = Z_STRLEN_P(backup);
446// user = Z_STRVAL_P(backup); 446// user = Z_STRVAL_P(backup);
447// } 447// }
448// 448//
449// cp = user; 449// cp = user;
450// while (cp < user+len) { 450// while (cp < user+len) {
451// if (*cp < 32) { 451// if (*cp < 32) {
@@ -458,7 +458,7 @@ function_exists_return:
458// } 458// }
459// cp++; 459// cp++;
460// } 460// }
461// 461//
462// if ((prefix != NULL && prefix[0]) || (postfix != NULL && postfix[0])) { 462// if ((prefix != NULL && prefix[0]) || (postfix != NULL && postfix[0])) {
463// if (prefix == NULL) { 463// if (prefix == NULL) {
464// prefix = ""; 464// prefix = "";
@@ -468,18 +468,18 @@ function_exists_return:
468// } 468// }
469// prefix_len = strlen(prefix); 469// prefix_len = strlen(prefix);
470// postfix_len = strlen(postfix); 470// postfix_len = strlen(postfix);
471// 471//
472// MAKE_STD_ZVAL(my_user); 472// MAKE_STD_ZVAL(my_user);
473// my_user->type = IS_STRING; 473// my_user->type = IS_STRING;
474// my_user->value.str.len = spprintf(&my_user->value.str.val, 0, "%s%s%s", prefix, user, postfix); 474// my_user->value.str.len = spprintf(&my_user->value.str.val, 0, "%s%s%s", prefix, user, postfix);
475// 475//
476// /* XXX: memory_leak? */ 476// /* XXX: memory_leak? */
477// *arg = my_user; 477// *arg = my_user;
478// 478//
479// len = Z_STRLEN_P(my_user); 479// len = Z_STRLEN_P(my_user);
480// user = Z_STRVAL_P(my_user); 480// user = Z_STRVAL_P(my_user);
481// } 481// }
482// 482//
483// if (user_match && user_match[0]) { 483// if (user_match && user_match[0]) {
484// #ifdef HAVE_FNMATCH 484// #ifdef HAVE_FNMATCH
485// if (fnmatch(user_match, user, 0) != 0) { 485// if (fnmatch(user_match, user, 0) != 0) {
@@ -498,10 +498,10 @@ function_exists_return:
498// } 498// }
499// #endif 499// #endif
500// } 500// }
501// 501//
502// SDEBUG("function: %s - user: %s", ih->name, user); 502// SDEBUG("function: %s - user: %s", ih->name, user);
503// 503//
504// return (0); 504// return (0);
505// } 505// }
506// 506//
507// 507//