1d1654b533
Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface GHSA-4w77-75f9-2c8w Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs CVE-2024-11234 Fix Single byte overread with convert.quoted-printable-decode filter CVE-2024-11233 Fix Leak partial content of the heap through heap buffer over-read CVE-2024-8929 Fix libxml streams use wrong `content-type` header when requesting a redirected resource CVE-2025-1219 Fix Stream HTTP wrapper header check might omit basic auth header CVE-2025-1736 Fix Stream HTTP wrapper truncate redirect location to 1024 bytes CVE-2025-1861 Fix Streams HTTP wrapper does not fail for headers without colon CVE-2025-1734 Fix Header parser of `http` stream wrapper does not handle folded headers CVE-2025-1217 Fix pgsql extension does not check for errors during escaping CVE-2025-1735 Fix NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix CVE-2025-6491 Fix Null byte termination in hostnames CVE-2025-1220 Fix Null byte termination in dns_get_record() GHSA-www2-q4fc-65wf Fix Heap buffer overflow in array_merge() CVE-2025-14178 Fix Information Leak of Memory in getimagesize CVE-2025-14177 Resolves: RHEL-141181
96 lines
3.5 KiB
Diff
96 lines
3.5 KiB
Diff
From 494de65139592da0e5e5b6fdf198c2f9c762f4d6 Mon Sep 17 00:00:00 2001
|
|
From: Jakub Zelenka <bukka@php.net>
|
|
Date: Fri, 8 Nov 2024 23:43:47 +0100
|
|
Subject: [PATCH 3/7] Fix GHSA-c5f2-jwm7-mmq2: stream HTTP fulluri CRLF
|
|
injection
|
|
|
|
(cherry picked from commit 426a6d4539ebee34879ac5de857036bb6ff0e732)
|
|
(cherry picked from commit bc1f192102dd8cbda028e40aa31604c4885d387c)
|
|
(cherry picked from commit 8d130e16fbfda7d154fedfa0f1ff1d5ad5e26815)
|
|
---
|
|
ext/standard/http_fopen_wrapper.c | 18 ++++++++----
|
|
.../tests/http/ghsa-c5f2-jwm7-mmq2.phpt | 28 +++++++++++++++++++
|
|
2 files changed, 40 insertions(+), 6 deletions(-)
|
|
create mode 100644 ext/standard/tests/http/ghsa-c5f2-jwm7-mmq2.phpt
|
|
|
|
diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
|
|
index 4d918b21e65..aeeb438f0f9 100644
|
|
--- a/ext/standard/http_fopen_wrapper.c
|
|
+++ b/ext/standard/http_fopen_wrapper.c
|
|
@@ -186,6 +186,11 @@ static php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper,
|
|
return NULL;
|
|
}
|
|
|
|
+ /* Should we send the entire path in the request line, default to no. */
|
|
+ if (context && (tmpzval = php_stream_context_get_option(context, "http", "request_fulluri")) != NULL) {
|
|
+ request_fulluri = zend_is_true(tmpzval);
|
|
+ }
|
|
+
|
|
use_ssl = resource->scheme && (ZSTR_LEN(resource->scheme) > 4) && ZSTR_VAL(resource->scheme)[4] == 's';
|
|
/* choose default ports */
|
|
if (use_ssl && resource->port == 0)
|
|
@@ -205,6 +210,13 @@ static php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper,
|
|
}
|
|
}
|
|
|
|
+ if (request_fulluri && (strchr(path, '\n') != NULL || strchr(path, '\r') != NULL)) {
|
|
+ php_stream_wrapper_log_error(wrapper, options, "HTTP wrapper full URI path does not allow CR or LF characters");
|
|
+ php_url_free(resource);
|
|
+ efree(transport_string);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
if (context && (tmpzval = php_stream_context_get_option(context, wrapper->wops->label, "timeout")) != NULL) {
|
|
double d = zval_get_double(tmpzval);
|
|
#ifndef PHP_WIN32
|
|
@@ -385,12 +397,6 @@ finish:
|
|
smart_str_appends(&req_buf, "GET ");
|
|
}
|
|
|
|
- /* Should we send the entire path in the request line, default to no. */
|
|
- if (!request_fulluri && context &&
|
|
- (tmpzval = php_stream_context_get_option(context, "http", "request_fulluri")) != NULL) {
|
|
- request_fulluri = zend_is_true(tmpzval);
|
|
- }
|
|
-
|
|
if (request_fulluri) {
|
|
/* Ask for everything */
|
|
smart_str_appends(&req_buf, path);
|
|
diff --git a/ext/standard/tests/http/ghsa-c5f2-jwm7-mmq2.phpt b/ext/standard/tests/http/ghsa-c5f2-jwm7-mmq2.phpt
|
|
new file mode 100644
|
|
index 00000000000..5b2e04f94f2
|
|
--- /dev/null
|
|
+++ b/ext/standard/tests/http/ghsa-c5f2-jwm7-mmq2.phpt
|
|
@@ -0,0 +1,28 @@
|
|
+--TEST--
|
|
+GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context might allow for CRLF injection in URIs)
|
|
+--INI--
|
|
+allow_url_fopen=1
|
|
+--CONFLICTS--
|
|
+server
|
|
+--FILE--
|
|
+<?php
|
|
+$serverCode = <<<'CODE'
|
|
+echo $_SERVER['REQUEST_URI'];
|
|
+CODE;
|
|
+
|
|
+include __DIR__."/../../../../sapi/cli/tests/php_cli_server.inc";
|
|
+php_cli_server_start($serverCode, null, []);
|
|
+
|
|
+$host = PHP_CLI_SERVER_ADDRESS;
|
|
+$userinput = "index.php HTTP/1.1\r\nHost: $host\r\n\r\nGET /index2.php HTTP/1.1\r\nHost: $host\r\n\r\nGET /index.php";
|
|
+$context = stream_context_create(['http' => ['proxy' => 'tcp://' . $host, 'request_fulluri' => true]]);
|
|
+echo file_get_contents("http://$host/$userinput", false, $context);
|
|
+?>
|
|
+--EXPECTF--
|
|
+Warning: file_get_contents(http://localhost:%d/index.php HTTP/1.1
|
|
+Host: localhost:%d
|
|
+
|
|
+GET /index2.php HTTP/1.1
|
|
+Host: localhost:%d
|
|
+
|
|
+GET /index.php): failed to open stream: HTTP wrapper full URI path does not allow CR or LF characters in %s on line %d
|
|
--
|
|
2.47.0
|
|
|