Package: php4 Version: 4:4.3.10-16 Followup-For: Bug #336645
here is a patch that applies cleanly on sarge: http://cvs.php.net/diff.php/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.2&r2=1.543.2.51.2.3&ty=h I append a modified patch that will apply cleanly on the sarge tree. I hope this is going to help getting this fixed. =================================================================== RCS file: /repository/php-src/ext/standard/basic_functions.c,v retrieving revision 1.543.2.51.2.2 retrieving revision 1.543.2.51.2.3 diff -p --unified=3 -r1.543.2.51.2.2 -r1.543.2.51.2.3 --- basic_functions.c 2005/09/13 13:23:56 1.543.2.51.2.2 +++ basic_functions.c 2005/09/29 16:31:48 1.543.2.51.2.3 @@ -3027,11 +3027,25 @@ prefix = va_arg(args, char *); prefix_len = va_arg(args, uint); - new_key_len = prefix_len + hash_key->nKeyLength; - new_key = (char *) emalloc(new_key_len); + if (!prefix_len) { + if (!hash_key->nKeyLength) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard."); + return 0; + } else if (!strcmp(hash_key->arKey, "GLOBALS")) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite."); + return 0; + } + } + + if (hash_key->nKeyLength) { + new_key_len = prefix_len + hash_key->nKeyLength; + new_key = (char *) emalloc(new_key_len); - memcpy(new_key, prefix, prefix_len); - memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength); + memcpy(new_key, prefix, prefix_len); + memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength); + } else { + new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h); + } zend_hash_del(&EG(symbol_table), new_key, new_key_len); ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0); -- System Information: Debian Release: 3.1 Architecture: i386 (i686) Kernel: Linux 2.4.31 Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Versions of packages php4 depends on: ii libapache-mod-php4 4:4.3.10-16 server-side, HTML-embedded scripti ii php4-common 4:4.3.10-16 Common files for packages built fr -- debconf information excluded -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
