summaryrefslogtreecommitdiff
path: root/src/sp_execute.c
diff options
context:
space:
mode:
authorjvoisin2018-10-06 16:15:00 +0000
committerGitHub2018-10-06 16:15:00 +0000
commitaa550b9abadc109a2c89a7cd6dd047ac2a953027 (patch)
tree1892e9ce8f833f3f13278cd424368fe1b5e26d91 /src/sp_execute.c
parent228fadf307b167a22ad6ec760f3b2ee2e9f2fee3 (diff)
Bump a bit the coverage
* `setcookie` doesn't always return `true` anymore * clang-format * Cookies with invalid decryption are dropped, but the request isn't anymore * faulty unserialize are now dumpable
Diffstat (limited to 'src/sp_execute.c')
-rw-r--r--src/sp_execute.c83
1 files changed, 44 insertions, 39 deletions
diff --git a/src/sp_execute.c b/src/sp_execute.c
index 6ed87cb..6def91b 100644
--- a/src/sp_execute.c
+++ b/src/sp_execute.c
@@ -13,13 +13,14 @@ static int (*orig_zend_stream_open)(const char *filename,
13 13
14// FIXME handle symlink 14// FIXME handle symlink
15ZEND_COLD static inline void terminate_if_writable(const char *filename) { 15ZEND_COLD static inline void terminate_if_writable(const char *filename) {
16 const sp_config_readonly_exec* config_ro_exec = 16 const sp_config_readonly_exec *config_ro_exec =
17 SNUFFLEUPAGUS_G(config).config_readonly_exec; 17 SNUFFLEUPAGUS_G(config).config_readonly_exec;
18 18
19 if (0 == access(filename, W_OK)) { 19 if (0 == access(filename, W_OK)) {
20 if (config_ro_exec->dump) { 20 if (config_ro_exec->dump) {
21 sp_log_request(config_ro_exec->dump, config_ro_exec->textual_representation, 21 sp_log_request(config_ro_exec->dump,
22 SP_TOKEN_READONLY_EXEC); 22 config_ro_exec->textual_representation,
23 SP_TOKEN_READONLY_EXEC);
23 } 24 }
24 if (true == config_ro_exec->simulation) { 25 if (true == config_ro_exec->simulation) {
25 sp_log_msg("readonly_exec", SP_LOG_SIMULATION, 26 sp_log_msg("readonly_exec", SP_LOG_SIMULATION,
@@ -31,8 +32,10 @@ ZEND_COLD static inline void terminate_if_writable(const char *filename) {
31 } 32 }
32 } else { 33 } else {
33 if (EACCES != errno) { 34 if (EACCES != errno) {
35 // LCOV_EXCL_START
34 sp_log_err("Writable execution", "Error while accessing %s: %s", filename, 36 sp_log_err("Writable execution", "Error while accessing %s: %s", filename,
35 strerror(errno)); 37 strerror(errno));
38 // LCOV_EXCL_STOP
36 } 39 }
37 } 40 }
38} 41}
@@ -82,7 +85,7 @@ is_in_eval_and_whitelisted(const zend_execute_data *execute_data) {
82 if (UNEXPECTED(false == check_is_in_eval_whitelist(current_function))) { 85 if (UNEXPECTED(false == check_is_in_eval_whitelist(current_function))) {
83 if (config_eval->dump) { 86 if (config_eval->dump) {
84 sp_log_request(config_eval->dump, config_eval->textual_representation, 87 sp_log_request(config_eval->dump, config_eval->textual_representation,
85 SP_TOKEN_EVAL_WHITELIST); 88 SP_TOKEN_EVAL_WHITELIST);
86 } 89 }
87 if (config_eval->simulation) { 90 if (config_eval->simulation) {
88 sp_log_msg( 91 sp_log_msg(
@@ -123,7 +126,7 @@ zend_string *get_eval_filename(const char *const filename) {
123 126
124static void sp_execute_ex(zend_execute_data *execute_data) { 127static void sp_execute_ex(zend_execute_data *execute_data) {
125 is_in_eval_and_whitelisted(execute_data); 128 is_in_eval_and_whitelisted(execute_data);
126 const HashTable* config_disabled_functions = 129 const HashTable *config_disabled_functions =
127 SNUFFLEUPAGUS_G(config).config_disabled_functions; 130 SNUFFLEUPAGUS_G(config).config_disabled_functions;
128 131
129 if (!execute_data) { 132 if (!execute_data) {
@@ -131,11 +134,12 @@ static void sp_execute_ex(zend_execute_data *execute_data) {
131 } 134 }
132 135
133 if (UNEXPECTED(EX(func)->op_array.type == ZEND_EVAL_CODE)) { 136 if (UNEXPECTED(EX(func)->op_array.type == ZEND_EVAL_CODE)) {
134 const sp_list_node * config = zend_hash_str_find_ptr( 137 const sp_list_node *config = zend_hash_str_find_ptr(
135 config_disabled_functions, "eval", sizeof("eval") - 1); 138 config_disabled_functions, "eval", sizeof("eval") - 1);
136 139
137 zend_string *filename = get_eval_filename(zend_get_executed_filename()); 140 zend_string *filename = get_eval_filename(zend_get_executed_filename());
138 is_builtin_matching(filename, "eval", NULL, config, config_disabled_functions); 141 is_builtin_matching(filename, "eval", NULL, config,
142 config_disabled_functions);
139 zend_string_release(filename); 143 zend_string_release(filename);
140 144
141 SNUFFLEUPAGUS_G(in_eval)++; 145 SNUFFLEUPAGUS_G(in_eval)++;
@@ -153,9 +157,9 @@ static void sp_execute_ex(zend_execute_data *execute_data) {
153 if (SNUFFLEUPAGUS_G(config).hook_execute) { 157 if (SNUFFLEUPAGUS_G(config).hook_execute) {
154 char *function_name = get_complete_function_path(execute_data); 158 char *function_name = get_complete_function_path(execute_data);
155 zval ret_val; 159 zval ret_val;
156 const sp_list_node* config_disabled_functions_reg = 160 const sp_list_node *config_disabled_functions_reg =
157 SNUFFLEUPAGUS_G(config).config_disabled_functions_reg 161 SNUFFLEUPAGUS_G(config)
158 ->disabled_functions; 162 .config_disabled_functions_reg->disabled_functions;
159 163
160 if (!function_name) { 164 if (!function_name) {
161 orig_execute_ex(execute_data); 165 orig_execute_ex(execute_data);
@@ -166,10 +170,10 @@ static void sp_execute_ex(zend_execute_data *execute_data) {
166 !execute_data->prev_execute_data->func || 170 !execute_data->prev_execute_data->func ||
167 !ZEND_USER_CODE(execute_data->prev_execute_data->func->type) || 171 !ZEND_USER_CODE(execute_data->prev_execute_data->func->type) ||
168 !execute_data->prev_execute_data->opline) { 172 !execute_data->prev_execute_data->opline) {
169 if (UNEXPECTED(true == 173 if (UNEXPECTED(true == should_disable_ht(execute_data, function_name,
170 should_disable_ht(execute_data, function_name, NULL, NULL, 174 NULL, NULL,
171 config_disabled_functions_reg, 175 config_disabled_functions_reg,
172 config_disabled_functions))) { 176 config_disabled_functions))) {
173 zend_bailout(); 177 zend_bailout();
174 } 178 }
175 } else if ((execute_data->prev_execute_data->opline->opcode == 179 } else if ((execute_data->prev_execute_data->opline->opcode ==
@@ -178,16 +182,17 @@ static void sp_execute_ex(zend_execute_data *execute_data) {
178 ZEND_DO_UCALL || 182 ZEND_DO_UCALL ||
179 execute_data->prev_execute_data->opline->opcode == 183 execute_data->prev_execute_data->opline->opcode ==
180 ZEND_DO_FCALL_BY_NAME)) { 184 ZEND_DO_FCALL_BY_NAME)) {
181 if (UNEXPECTED(true == 185 if (UNEXPECTED(true == should_disable_ht(execute_data, function_name,
182 should_disable_ht(execute_data, function_name, NULL, NULL, 186 NULL, NULL,
183 config_disabled_functions_reg, 187 config_disabled_functions_reg,
184 config_disabled_functions))) { 188 config_disabled_functions))) {
185 zend_bailout(); 189 zend_bailout();
186 } 190 }
187 } 191 }
188 192
189 // When a function's return value isn't used, php doesn't store it in the execute_data, 193 // When a function's return value isn't used, php doesn't store it in the
190 // so we need to use a local variable to be able to match on it later. 194 // execute_data, so we need to use a local variable to be able to match on
195 // it later.
191 if (EX(return_value) == NULL) { 196 if (EX(return_value) == NULL) {
192 memset(&ret_val, 0, sizeof(ret_val)); 197 memset(&ret_val, 0, sizeof(ret_val));
193 EX(return_value) = &ret_val; 198 EX(return_value) = &ret_val;
@@ -196,13 +201,13 @@ static void sp_execute_ex(zend_execute_data *execute_data) {
196 orig_execute_ex(execute_data); 201 orig_execute_ex(execute_data);
197 202
198 if (UNEXPECTED( 203 if (UNEXPECTED(
199 true == 204 true ==
200 should_drop_on_ret_ht( 205 should_drop_on_ret_ht(
201 EX(return_value), function_name, 206 EX(return_value), function_name,
202 SNUFFLEUPAGUS_G(config) 207 SNUFFLEUPAGUS_G(config)
203 .config_disabled_functions_reg_ret->disabled_functions, 208 .config_disabled_functions_reg_ret->disabled_functions,
204 SNUFFLEUPAGUS_G(config).config_disabled_functions_ret, 209 SNUFFLEUPAGUS_G(config).config_disabled_functions_ret,
205 execute_data))) { 210 execute_data))) {
206 zend_bailout(); 211 zend_bailout();
207 } 212 }
208 efree(function_name); 213 efree(function_name);
@@ -213,14 +218,14 @@ static void sp_execute_ex(zend_execute_data *execute_data) {
213 } else { 218 } else {
214 orig_execute_ex(execute_data); 219 orig_execute_ex(execute_data);
215 } 220 }
216
217} 221}
218 222
219static void sp_zend_execute_internal(INTERNAL_FUNCTION_PARAMETERS) { 223static void sp_zend_execute_internal(INTERNAL_FUNCTION_PARAMETERS) {
220 is_in_eval_and_whitelisted(execute_data); 224 is_in_eval_and_whitelisted(execute_data);
221 225
222 if (UNEXPECTED(NULL != orig_zend_execute_internal)) { 226 if (UNEXPECTED(NULL != orig_zend_execute_internal)) {
223 orig_zend_execute_internal(INTERNAL_FUNCTION_PARAM_PASSTHRU); 227 orig_zend_execute_internal(
228 INTERNAL_FUNCTION_PARAM_PASSTHRU); // LCOV_EXCL_LINE
224 } else { 229 } else {
225 EX(func)->internal_function.handler(INTERNAL_FUNCTION_PARAM_PASSTHRU); 230 EX(func)->internal_function.handler(INTERNAL_FUNCTION_PARAM_PASSTHRU);
226 } 231 }
@@ -235,7 +240,7 @@ static int sp_stream_open(const char *filename, zend_file_handle *handle) {
235 } 240 }
236 241
237 zend_string *zend_filename = zend_string_init(filename, strlen(filename), 0); 242 zend_string *zend_filename = zend_string_init(filename, strlen(filename), 0);
238 const HashTable* disabled_functions_hooked = 243 const HashTable *disabled_functions_hooked =
239 SNUFFLEUPAGUS_G(config).config_disabled_functions_hooked; 244 SNUFFLEUPAGUS_G(config).config_disabled_functions_hooked;
240 245
241 switch (data->opline->opcode) { 246 switch (data->opline->opcode) {
@@ -247,32 +252,32 @@ static int sp_stream_open(const char *filename, zend_file_handle *handle) {
247 case ZEND_INCLUDE: 252 case ZEND_INCLUDE:
248 is_builtin_matching( 253 is_builtin_matching(
249 zend_filename, "include", "inclusion path", 254 zend_filename, "include", "inclusion path",
250 zend_hash_str_find_ptr(disabled_functions_hooked, 255 zend_hash_str_find_ptr(disabled_functions_hooked, "include",
251 "include", sizeof("include") - 1), 256 sizeof("include") - 1),
252 disabled_functions_hooked); 257 disabled_functions_hooked);
253 break; 258 break;
254 case ZEND_REQUIRE: 259 case ZEND_REQUIRE:
255 is_builtin_matching( 260 is_builtin_matching(
256 zend_filename, "require", "inclusion path", 261 zend_filename, "require", "inclusion path",
257 zend_hash_str_find_ptr(disabled_functions_hooked, 262 zend_hash_str_find_ptr(disabled_functions_hooked, "require",
258 "require", sizeof("require") - 1), 263 sizeof("require") - 1),
259 disabled_functions_hooked); 264 disabled_functions_hooked);
260 break; 265 break;
261 case ZEND_REQUIRE_ONCE: 266 case ZEND_REQUIRE_ONCE:
262 is_builtin_matching( 267 is_builtin_matching(
263 zend_filename, "require_once", "inclusion path", 268 zend_filename, "require_once", "inclusion path",
264 zend_hash_str_find_ptr(disabled_functions_hooked, 269 zend_hash_str_find_ptr(disabled_functions_hooked, "require_once",
265 "require_once", sizeof("require_once") - 1), 270 sizeof("require_once") - 1),
266 disabled_functions_hooked); 271 disabled_functions_hooked);
267 break; 272 break;
268 case ZEND_INCLUDE_ONCE: 273 case ZEND_INCLUDE_ONCE:
269 is_builtin_matching( 274 is_builtin_matching(
270 zend_filename, "include_once", "inclusion path", 275 zend_filename, "include_once", "inclusion path",
271 zend_hash_str_find_ptr(disabled_functions_hooked, 276 zend_hash_str_find_ptr(disabled_functions_hooked, "include_once",
272 "include_once", sizeof("include_once") - 1), 277 sizeof("include_once") - 1),
273 disabled_functions_hooked); 278 disabled_functions_hooked);
274 break; 279 break;
275 EMPTY_SWITCH_DEFAULT_CASE(); 280 EMPTY_SWITCH_DEFAULT_CASE(); // LCOV_EXCL_LINE
276 } 281 }
277 } 282 }
278 efree(zend_filename); 283 efree(zend_filename);