OOPS-ORG-PHP/mod_execdir

proc_open_re :: argument string duplicate check

Joungkyun opened this issue · 0 comments

In the function "get_command_from_array" in proc_open.c, argument string check is performed in get_valid_arg_string, but there is a problem of duplicating once more.

    ZEND_HASH_FOREACH_VAL(array, arg_zv) {
        zend_string *arg_str = get_valid_arg_string(arg_zv, i + 1);
        if (!arg_str) {
            /* Terminate with NULL so exit_fail code knows how many entries to free */
            (*argv)[i] = NULL;
            if (command != NULL) {
                efree(command);
            }
            return NULL;
        }

        if (i == 0) {
#ifdef HAVE_EXECDIR
            if (strlen(ZSTR_VAL(arg_str)) != ZSTR_LEN(arg_str)) {
                php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
                return NULL;
            }
            {
                char * jcommand = get_jailed_shell_cmd (ZSTR_VAL(arg_str));
                if (jcommand == NULL)
                    return NULL;
                command = estrdup(jcommand);
                efree (jcommand);
            }
#else
            command = estrdup(ZSTR_VAL(arg_str));
#endif
        }

        (*argv)[i++] = estrdup(ZSTR_VAL(arg_str));
        zend_string_release(arg_str);
    } ZEND_HASH_FOREACH_END();