Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57517
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain ktamura.com from 209.85.210.170 cause and error)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Date: Wed, 25 Jan 2012 16:43:07 -0800
Message-ID: <38EE3732-F134-4C02-8F93-2E9C61FD1E81@ktamura.com>
To: internals@lists.php.net
Mime-Version: 1.0 (Apple Message framework v1084)
Subject: A potential patch for Bug#60668
From: me@ktamura.com (Kiyoto Tamura)

vrana has raise a good point in a potentially dangerous behavior with =
ini_set() in https://bugs.php.net/bug.php?id=3D60668.

Here is my proposed patch. Feedback is appreciated. Thanks!

Kiyoto Tamura

diff --git a/Zend/zend_ini.c b/Zend/zend_ini.c
index a7ec5d7..89b1287 100644
--- a/Zend/zend_ini.c
+++ b/Zend/zend_ini.c
@@ -83,6 +83,23 @@ static int =
zend_restore_ini_entry_wrapper(zend_ini_entry **ini_entry TSRMLS_DC)
 }
 /* }}} */
=20
+static uint zend_trim_after_carriage_return(char *value, uint =
value_length) /* {{{ */
+{
+    uint ii;
+    char prev_c =3D '\0', curr_c;
+    for (ii =3D 0; ii < value_length; ++ii) {
+        curr_c =3D *value;
+        if (prev_c =3D=3D '\r' && curr_c =3D=3D '\n') {
+            return ii - 1;
+        }
+        prev_c =3D curr_c;
+        ++value;
+    }
+   =20
+    return value_length;
+}
+/* }}} */
+
 /*
  * Startup / shutdown
  */
@@ -288,6 +305,11 @@ ZEND_API int zend_alter_ini_entry_ex(char *name, =
uint name_length, char *new_val
 		zend_hash_add(EG(modified_ini_directives), name, =
name_length, &ini_entry, sizeof(zend_ini_entry*), NULL);
 	}
=20
+    // per Bug #60668, truncate the string after /r/n for user_agent =
for security
+    if (strcmp(name, "user_agent") =3D=3D 0) {
+        new_value_length =3D zend_trim_after_carriage_return(new_value, =
new_value_length);      =20
+    }
+
 	duplicate =3D estrndup(new_value, new_value_length);
=20
 	if (!ini_entry->on_modify
@@ -672,6 +694,7 @@ ZEND_API ZEND_INI_MH(OnUpdateStringUnempty) /* {{{ =
*/
 	*p =3D new_value;
 	return SUCCESS;
 }
 /* }}} */
=20
 /*