Skip to content

Fixed bug #61043 (Regression in magic_quotes_gpc fix for CVE-2012-0831) #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 21, 2012
Merged

Fixed bug #61043 (Regression in magic_quotes_gpc fix for CVE-2012-0831) #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions main/php_variables.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -450,7 +450,7 @@ void _php_import_environment_variables(zval *array_ptr TSRMLS_DC)
/* turn off magic_quotes while importing environment variables */
int magic_quotes_gpc = PG(magic_quotes_gpc);

if (PG(magic_quotes_gpc)) {
if (magic_quotes_gpc) {
zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
}

Expand All @@ -471,7 +471,10 @@ void _php_import_environment_variables(zval *array_ptr TSRMLS_DC)
if (t != buf && t != NULL) {
efree(t);
}
PG(magic_quotes_gpc) = magic_quotes_gpc;

if (magic_quotes_gpc) {
zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "1", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
}
}

zend_bool php_std_auto_global_callback(char *name, uint name_len TSRMLS_DC)
Expand Down Expand Up @@ -595,7 +598,7 @@ static inline void php_register_server_variables(TSRMLS_D)
zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_SERVER]);
}
PG(http_globals)[TRACK_VARS_SERVER] = array_ptr;
if (PG(magic_quotes_gpc)) {
if (magic_quotes_gpc) {
zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
}

Expand All @@ -622,7 +625,9 @@ static inline void php_register_server_variables(TSRMLS_D)
php_register_variable_ex("REQUEST_TIME", &new_entry, array_ptr TSRMLS_CC);
}

PG(magic_quotes_gpc) = magic_quotes_gpc;
if (magic_quotes_gpc) {
zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "1", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
}
}
/* }}} */

Expand Down
6 changes: 4 additions & 2 deletions sapi/cgi/cgi_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -624,7 +624,7 @@ void cgi_php_import_environment_variables(zval *array_ptr TSRMLS_DC)
int filter_arg = (array_ptr == PG(http_globals)[TRACK_VARS_ENV])?PARSE_ENV:PARSE_SERVER;

/* turn off magic_quotes while importing environment variables */
if (PG(magic_quotes_gpc)) {
if (magic_quotes_gpc) {
zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
}
for (zend_hash_internal_pointer_reset_ex(request->env, &pos);
Expand All @@ -638,7 +638,9 @@ void cgi_php_import_environment_variables(zval *array_ptr TSRMLS_DC)
php_register_variable_safe(var, *val, new_val_len, array_ptr TSRMLS_CC);
}
}
PG(magic_quotes_gpc) = magic_quotes_gpc;
if (magic_quotes_gpc) {
zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "1", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
}
}
}

Expand Down
6 changes: 4 additions & 2 deletions sapi/fpm/fpm/fpm_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -595,7 +595,7 @@ void cgi_php_import_environment_variables(zval *array_ptr TSRMLS_DC)
filter_arg = (array_ptr == PG(http_globals)[TRACK_VARS_ENV])?PARSE_ENV:PARSE_SERVER;

/* turn off magic_quotes while importing environment variables */
if (PG(magic_quotes_gpc)) {
if (magic_quotes_gpc) {
zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
}
for (zend_hash_internal_pointer_reset_ex(request->env, &pos);
Expand All @@ -609,7 +609,9 @@ void cgi_php_import_environment_variables(zval *array_ptr TSRMLS_DC)
php_register_variable_safe(var, *val, new_val_len, array_ptr TSRMLS_CC);
}
}
PG(magic_quotes_gpc) = magic_quotes_gpc;
if (magic_quotes_gpc) {
zend_alter_ini_entry_ex("magic_quotes_gpc", sizeof("magic_quotes_gpc"), "1", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_ACTIVATE, 1 TSRMLS_CC);
}
}

static void sapi_cgi_register_variables(zval *track_vars_array TSRMLS_DC)
Expand Down
10 changes: 10 additions & 0 deletions tests/basic/magic_quotes_gpc.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
--TEST--
Bug #61043 (Regression in magic_quotes_gpc fix for CVE-2012-0831)
--INI--
magic_quotes_gpc=On
--FILE--
<?php
var_dump(ini_get("magic_quotes_gpc"));
?>
--EXPECT--
string(1) "1"