From f452b9056e89aa1bf18d6c0828ba709c0f8df854 Mon Sep 17 00:00:00 2001 From: Rasmus Lerdorf Date: Mon, 5 Nov 2012 20:56:19 -0800 Subject: [PATCH 1/5] These need to be volatile in order to prevent leaking after the longjmp in the error handler --- ext/gd/libgd/gd_png.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c index 49f7cb07772..bdbb7ee7d3e 100644 --- a/ext/gd/libgd/gd_png.c +++ b/ext/gd/libgd/gd_png.c @@ -127,8 +127,8 @@ gdImagePtr gdImageCreateFromPngCtx (gdIOCtx * infile) png_color_16p trans_gray_rgb; png_color_16p trans_color_rgb; png_bytep trans; - png_bytep image_data = NULL; - png_bytepp row_pointers = NULL; + volatile png_bytep image_data = NULL; + volatile png_bytepp row_pointers = NULL; gdImagePtr im = NULL; int i, j, *open = NULL; volatile int transparent = -1; From f8c280d85a3fc5b02e9b19f4e23ddac233abf1e4 Mon Sep 17 00:00:00 2001 From: Rasmus Lerdorf Date: Mon, 5 Nov 2012 20:56:19 -0800 Subject: [PATCH 2/5] These need to be volatile in order to prevent leaking after the longjmp in the error handler --- ext/gd/libgd/gd_png.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c index 49f7cb07772..bdbb7ee7d3e 100644 --- a/ext/gd/libgd/gd_png.c +++ b/ext/gd/libgd/gd_png.c @@ -127,8 +127,8 @@ gdImagePtr gdImageCreateFromPngCtx (gdIOCtx * infile) png_color_16p trans_gray_rgb; png_color_16p trans_color_rgb; png_bytep trans; - png_bytep image_data = NULL; - png_bytepp row_pointers = NULL; + volatile png_bytep image_data = NULL; + volatile png_bytepp row_pointers = NULL; gdImagePtr im = NULL; int i, j, *open = NULL; volatile int transparent = -1; From 7caca1614beaaab581c9ed3be002745af25cf971 Mon Sep 17 00:00:00 2001 From: Rasmus Lerdorf Date: Mon, 5 Nov 2012 21:04:33 -0800 Subject: [PATCH 3/5] News entry for png memleak fix --- NEWS | 1 + 1 file changed, 1 insertion(+) diff --git a/NEWS b/NEWS index 293dcb0ffda..d476cec6abb 100644 --- a/NEWS +++ b/NEWS @@ -1341,6 +1341,7 @@ PHP NEWS - Gd: . Fixed bug #60160 (imagefill() doesn't work correctly for small images). (Florian) + . Fixed potential memory leak on a png error (Rasmus, Paul Saab) - Intl: . Fixed bug #60192 (SegFault when Collator not constructed From 0ee5d18f91d731636f3ba39c7487e2a8cf04fa36 Mon Sep 17 00:00:00 2001 From: Rasmus Lerdorf Date: Mon, 5 Nov 2012 21:06:18 -0800 Subject: [PATCH 4/5] News entry for png memleak fix --- NEWS | 1 + 1 file changed, 1 insertion(+) diff --git a/NEWS b/NEWS index 2e1f13bd5e5..83274c20f21 100644 --- a/NEWS +++ b/NEWS @@ -1395,6 +1395,7 @@ PHP NEWS - GD extension: . Fixed bug #53492 (fix crash if anti-aliasing steps are invalid). (Pierre) + . Fixed potential memory leak on a png error (Rasmus, Paul Saab) - GMP extension: . Fixed bug #52906 (gmp_mod returns negative result when non-negative is From 7fcbe4d5467300a0acee78330a0cdc9d1cbf05ad Mon Sep 17 00:00:00 2001 From: Xinchen Hui Date: Wed, 7 Nov 2012 17:05:24 +0800 Subject: [PATCH 5/5] Fixed bug #63447 (max_input_vars doesn't filter variables when mbstring.encoding_translation = On) --- NEWS | 4 ++++ ext/mbstring/mb_gpc.c | 6 +++++ ext/mbstring/tests/bug63447_001.phpt | 20 ++++++++++++++++ ext/mbstring/tests/bug63447_002.phpt | 20 ++++++++++++++++ ext/mbstring/tests/bug63447_003.phpt | 34 ++++++++++++++++++++++++++++ 5 files changed, 84 insertions(+) create mode 100644 ext/mbstring/tests/bug63447_001.phpt create mode 100644 ext/mbstring/tests/bug63447_002.phpt create mode 100644 ext/mbstring/tests/bug63447_003.phpt diff --git a/NEWS b/NEWS index 83274c20f21..d03a2da4f9e 100644 --- a/NEWS +++ b/NEWS @@ -12,6 +12,10 @@ PHP NEWS . Fixed bug #63389 (Missing context check on libxml_set_streams_context() causes memleak). (Laruence) +- Mbstring: + . Fixed bug #63447 (max_input_vars doesn't filter variables when + mbstring.encoding_translation = On). (Laruence) + - MySQL: . Fixed compilation failure on mixed 32/64 bit systems. (Andrey) diff --git a/ext/mbstring/mb_gpc.c b/ext/mbstring/mb_gpc.c index dd60302d03a..b35ece31de7 100644 --- a/ext/mbstring/mb_gpc.c +++ b/ext/mbstring/mb_gpc.c @@ -262,6 +262,12 @@ enum mbfl_no_encoding _php_mb_encoding_handler_ex(const php_mb_encoding_handler_ n++; var = php_strtok_r(NULL, info->separator, &strtok_buf); } + + if (n > (PG(max_input_vars) * 2)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars)); + goto out; + } + num = n; /* make sure to process initilized vars only */ /* initialize converter */ diff --git a/ext/mbstring/tests/bug63447_001.phpt b/ext/mbstring/tests/bug63447_001.phpt new file mode 100644 index 00000000000..51302994dbd --- /dev/null +++ b/ext/mbstring/tests/bug63447_001.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #63447 (max_input_vars doesn't filter variables when mbstring.encoding_translation = On) +--SKIPIF-- + +--INI-- +max_input_nesting_level=10 +max_input_vars=5 +mbstring.encoding_translation=1 +--POST-- +a=1&b=2&c=3&d=4&e=5&f=6 +--FILE-- + +--EXPECT-- +Warning: Unknown: Input variables exceeded 5. To increase the limit change max_input_vars in php.ini. in Unknown on line 0 +array(0) { +} diff --git a/ext/mbstring/tests/bug63447_002.phpt b/ext/mbstring/tests/bug63447_002.phpt new file mode 100644 index 00000000000..e51089b7942 --- /dev/null +++ b/ext/mbstring/tests/bug63447_002.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #63447 (max_input_vars doesn't filter variables when mbstring.encoding_translation = On) +--SKIPIF-- + +--INI-- +max_input_nesting_level=10 +max_input_vars=4 +mbstring.encoding_translation=1 +--POST-- +a=1&b=2&c=3&d=4&e=5 +--FILE-- + +--EXPECT-- +Warning: Unknown: Input variables exceeded 4. To increase the limit change max_input_vars in php.ini. in Unknown on line 0 +array(0) { +} diff --git a/ext/mbstring/tests/bug63447_003.phpt b/ext/mbstring/tests/bug63447_003.phpt new file mode 100644 index 00000000000..a4a7e14851f --- /dev/null +++ b/ext/mbstring/tests/bug63447_003.phpt @@ -0,0 +1,34 @@ +--TEST-- +Bug #63447 (max_input_vars doesn't filter variables when mbstring.encoding_translation = On) +--SKIPIF-- + +--INI-- +max_input_nesting_level=5 +max_input_vars=100 +mbstring.encoding_translation=1 +--POST-- +a=1&b[][][]=2&c[][][][][][]=7 +--FILE-- + +--EXPECT-- +Array +( + [a] => 1 + [b] => Array + ( + [0] => Array + ( + [0] => Array + ( + [0] => 2 + ) + + ) + + ) + +)