proc_open_re :: argument string duplicate check
Joungkyun opened this issue · 0 comments
Joungkyun commented
In the function "get_command_from_array" in proc_open.c, argument string check is performed in get_valid_arg_string, but there is a problem of duplicating once more.
ZEND_HASH_FOREACH_VAL(array, arg_zv) {
zend_string *arg_str = get_valid_arg_string(arg_zv, i + 1);
if (!arg_str) {
/* Terminate with NULL so exit_fail code knows how many entries to free */
(*argv)[i] = NULL;
if (command != NULL) {
efree(command);
}
return NULL;
}
if (i == 0) {
#ifdef HAVE_EXECDIR
if (strlen(ZSTR_VAL(arg_str)) != ZSTR_LEN(arg_str)) {
php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
return NULL;
}
{
char * jcommand = get_jailed_shell_cmd (ZSTR_VAL(arg_str));
if (jcommand == NULL)
return NULL;
command = estrdup(jcommand);
efree (jcommand);
}
#else
command = estrdup(ZSTR_VAL(arg_str));
#endif
}
(*argv)[i++] = estrdup(ZSTR_VAL(arg_str));
zend_string_release(arg_str);
} ZEND_HASH_FOREACH_END();