mirrors/php-src
0
0 Fork 0
mirror of https://github.com/php/php-src.git synced 2026-10-28 09:46:46 +08:00
Code Activity

Merge branch 'PHP-8.6'

Browse Source 
* PHP-8.6:
  curl: Fix UAF on clone due to callback data pointer mismatch
This commit is contained in:
ndossche committed 2026-10-27 20:44:39 +01:00
2 parents fb7fb98f68 f8176205c7
commit beb8d76332
2 files changed
+35 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ext/curl/interface.c
+8 -2
View File
@@ -796,6 +796,10 @@ static int curl_ssh_hostkeyfunction(void *clientp, int keytype, const char *key,
php_curl *ch = (php_curl *)clientp;
int rval = CURLKHMATCH_MISMATCH; /* cancel connection in case of an exception */
if (!ZEND_FCC_INITIALIZED(ch->handlers.sshhostkey)) {
return rval;
}
#if PHP_CURL_DEBUG
fprintf(stderr, "curl_ssh_hostkeyfunction() called\n");
fprintf(stderr, "clientp = %p, keytype = %d, key = %s, keylen = %zu\n", clientp, keytype, key, keylen);
@@ -1274,8 +1278,11 @@ static void php_curl_copy_fcc_with_option(php_curl *ch, CURLoption option, zend_
{
if (ZEND_FCC_INITIALIZED(*source_fcc)) {
zend_fcc_dup(target_fcc, source_fcc);
curl_easy_setopt(ch->cp, option, (void *) ch);
}
/* The callback data (i.e. pointer to the curl handle) stays even if a user callback
* is reset to NULL. Ensure the data pointer always points to the new handle. */
curl_easy_setopt(ch->cp, option, (void *) ch);
}
void _php_setup_easy_copy_handlers(php_curl *ch, php_curl *source)
@@ -1319,7 +1326,6 @@ void _php_setup_easy_copy_handlers(php_curl *ch, php_curl *source)
curl_easy_setopt(ch->cp, CURLOPT_FILE, (void *) ch);
curl_easy_setopt(ch->cp, CURLOPT_INFILE, (void *) ch);
curl_easy_setopt(ch->cp, CURLOPT_WRITEHEADER, (void *) ch);
curl_easy_setopt(ch->cp, CURLOPT_DEBUGDATA, (void *) ch);
php_curl_copy_fcc_with_option(ch, CURLOPT_SEEKDATA, &ch->handlers.seek, &source->handlers.seek);
php_curl_copy_fcc_with_option(ch, CURLOPT_PROGRESSDATA, &ch->handlers.progress, &source->handlers.progress);
ext/curl/tests/curl_copy_handle_progress_null_uaf.phpt
+27
View File
@@ -0,0 +1,27 @@
--TEST--
Cloning a curl handle whose CURLOPT_PROGRESSFUNCTION was reset to null must not reference the source handle
--EXTENSIONS--
curl
--FILE--
<?php
$srcfile = __DIR__ . '/curl_copy_handle_progress_null_uaf.txt';
file_put_contents($srcfile, "Test.");
$ch1 = curl_init();
curl_setopt($ch1, CURLOPT_URL, "file://" . $srcfile);
curl_setopt($ch1, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch1, CURLOPT_NOPROGRESS, false);
curl_setopt($ch1, CURLOPT_PROGRESSFUNCTION, fn() => 0);
curl_setopt($ch1, CURLOPT_PROGRESSFUNCTION, null);
$ch2 = clone $ch1;
unset($ch1);
var_dump(curl_exec($ch2));
?>
--CLEAN--
<?php
@unlink(__DIR__ . '/curl_copy_handle_progress_null_uaf.txt');
?>
--EXPECT--
string(5) "Test."