Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:39760
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.198.224 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:cc:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references;
        b=ooasD+KRwZ46htOioNKOPn0NNga1MgcC2Z5qLBjXVYSrUrRkHXQsPXnyaxhGNDiS0w
         NC04CtwFsuUP0pNV7lpATmWKjP5KkAeb04Fud2CCMIBxrOWRyuBl83LJTlb4kKOS0oat
         vhaalmJ0ZMbp+9vwW3xeJdVMJAzQH2eJMm8AY=
Message-ID: <fe05d1540808081023v155f6fdpdda82d15b4de5cb3@mail.gmail.com>
Date: Fri, 8 Aug 2008 19:23:00 +0200
To: "Dmitry Stogov" <dmitry@zend.com>
Cc: "Hannes Magnusson" <hannes.magnusson@gmail.com>, 
	"Arnaud Le Blanc" <arnaud.lb@gmail.com>, internals@lists.php.net, 
	"Rasmus Lerdorf" <rasmus@lerdorf.com>, 
	"Felipe Pena" <felipensp@gmail.com>, 
	"Christian Stocker" <christian.stocker@liip.ch>, 
	"Andi Gutmans" <andi@zend.com>, "Stanislav Malyshev" <stas@zend.com>
In-Reply-To: <489C6BBA.8030101@zend.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <4899C4B4.3060902@liip.ch> <1218138548.5346.3.camel@felipe>
	 <489B5285.1070000@lerdorf.com>
	 <200808072237.01841.arnaud.lb@gmail.com>
	 <7f3ed2c30808080011l3c62d416k7fd9b4dd455df99e@mail.gmail.com>
	 <489C6BBA.8030101@zend.com>
Subject: Re: [PHP-DEV] include bug in 5.3
From: pierre.php@gmail.com ("Pierre Joye")

Hi Dmitry,

On Fri, Aug 8, 2008 at 5:52 PM, Dmitry Stogov <dmitry@zend.com> wrote:
> Hi,
>
> The attached patch is going to fix the problem.
> It implements its own realpath() function, so we won't depend on system
> anymore. It also improve realpath cache usage by caching intermediate
> results.
>
> I tested it on Linux and Windows only and it seems to work without
> problems. It breaks one test related to clearstatcache() function, but
> this break is expected.
>
> Could you please test it.

I can test it asap on various windows, probably on Monday.

After a quick review, it seems that FindClose is missing in the two
buffer overflow check.

> -                               state->cwd_length += ptr_length;
> +#ifdef TSRM_WIN32
> +               if ((hFind = FindFirstFile(to, &data)) != INVALID_HANDLE_VALUE) {
> +fprintf(stderr, "1 %s (%d)\n", to, len);
> +                       j = strlen(data.cFileName);
> +
> +                       i = len;
> +                       while (!IS_SLASH(to[i-1])) {
> +                               i--;
> +                       }
> +                       if (i + j >= MAXPATHLEN-1) {
> +                               /*buffer overflow */

FindClose(hFind);

> +                               return NULL;
> +                       }
> +                       if (CWDG(realpath_cache_size_limit)) {
> +                               memcpy(tmp, to, i);
> +                               memcpy(tmp + i, data.cFileName, j + 1);
> +                               realpath_cache_add(to, len, tmp, i + j, t TSRMLS_CC);
> +                       }
> +                       ret -= (j + 1);
> +                       if (ret < buf) {
> +                               /* buffer overflow */

FindClose(hFind);

> +                               return NULL;
> +                       }
> +                       *ret = DEFAULT_SLASH;
> +                       memcpy(ret+1, data.cFileName, j);
> +                       FindClose(hFind);
> +                       len = i - 1;
> +                       to[len] = 0;
> +fprintf(stderr, "2 %s - %s\n", to, ret);
> +                       continue;
> +               } else {
> +                       if (use_realpath == CWD_REALPATH) {
> +                               return NULL;
> +                       } else {
> +                               goto next_dir;
>                        }
> -                       ptr = tsrm_strtok_r(NULL, TOKENIZER_STRING, &tok);
>                }

Thanks for your work!
-- 
Pierre

http://blog.thepimp.net | http://www.libgd.org