Skip to content

Commit 68ec278

Browse files
committed
Fix GH-17797: zend_test_compile_string crash on invalid script path.
When looking for the last slash of the script path, it leads to underflow being promoted to SIZE_MAX being way beyond MAXPATHLEN.
1 parent a54af45 commit 68ec278

File tree

2 files changed

+39
-2
lines changed

2 files changed

+39
-2
lines changed

Diff for: ext/zend_test/tests/gh17797.phpt

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
--TEST--
2+
GH-17797 (zend_test_compile_string crash on invalid script path)
3+
--EXTENSIONS--
4+
zend_test
5+
--CREDITS--
6+
YuanchengJiang
7+
--FILE--
8+
<?php
9+
$source = '<?php
10+
require("sumfile.php");
11+
?>';
12+
try {zend_test_compile_string($source,$source,$c);} catch (Exception $e) { echo($e); }
13+
--EXPECTF--
14+
15+
Warning: Undefined variable $c in %s on line %d
16+
17+
Deprecated: zend_test_compile_string(): Passing null to parameter #3 ($position) of type int is deprecated in %s on line %d
18+
19+
Warning: require(sumfile.php): Failed to open stream: No such file or directory in <?php
20+
require("sumfile.php");
21+
?> on line %d
22+
23+
Fatal error: Uncaught Error: Failed opening required 'sumfile.php' (include_path='.%s') in <?php
24+
require("sumfile.php");
25+
?>:%d
26+
Stack trace:
27+
#0 %s(%d): zend_test_compile_string('<?php\nrequire("...', '<?php\nrequire("...', NULL)
28+
#1 {main}
29+
thrown in <?php
30+
require("sumfile.php");
31+
?> on line %d

Diff for: main/fopen_wrappers.c

+8-2
Original file line numberDiff line numberDiff line change
@@ -600,10 +600,16 @@ PHPAPI zend_string *php_resolve_path(const char *filename, size_t filename_lengt
600600
*/
601601
if (zend_is_executing() &&
602602
(exec_filename = zend_get_executed_filename_ex()) != NULL) {
603+
if (ZSTR_LEN(exec_filename) == 0) {
604+
return NULL;
605+
}
603606
const char *exec_fname = ZSTR_VAL(exec_filename);
604-
size_t exec_fname_length = ZSTR_LEN(exec_filename);
607+
size_t exec_fname_length = ZSTR_LEN(exec_filename) - 1;
608+
609+
while (exec_fname_length != 0 && !IS_SLASH(exec_fname[exec_fname_length])) {
610+
--exec_fname_length;
611+
}
605612

606-
while ((--exec_fname_length < SIZE_MAX) && !IS_SLASH(exec_fname[exec_fname_length]));
607613
if (exec_fname_length > 0 &&
608614
filename_length < (MAXPATHLEN - 2) &&
609615
exec_fname_length + 1 + filename_length + 1 < MAXPATHLEN) {

0 commit comments

Comments
 (0)