[pull] master from php:master

NEWS

@@ -7,6 +7,8 @@ PHP                                                                        NEWS
     n_scale. (Ilia Alshanetsky)
 
 - Core:
+  . Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.
+    (Yudai Takada)
   . Calling is_a() or is_subclass_of() with a string as the first argument
     when $allow_string is false is now deprecated. (Daniel Scherzer)
   . Fixed bug GH-23232 (lone namespace separator asks the autoloader for an

Zend/tests/multibyte/multibyte_encoding_008.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Zend Multibyte does not read past the script during UTF-16 detection
+--EXTENSIONS--
+mbstring
+--INI--
+zend.multibyte=1
+internal_encoding=UTF-8
+--FILE--
+<?php
+$filename = __DIR__ . '/multibyte_encoding_008.tmp.php';
+file_put_contents($filename, "<\0?\0p\0h\0p\0");
+include $filename;
+echo "Done\n";
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/multibyte_encoding_008.tmp.php');
+?>
+--EXPECT--
+Done

Zend/zend_language_scanner.l

@@ -332,14 +332,13 @@ ZEND_API zend_result zend_lex_tstring(zval *zv, unsigned char *ident)
 static const zend_encoding *zend_multibyte_detect_utf_encoding(const unsigned char *script, size_t script_size)
 {
 	const unsigned char *p;
+	size_t offset = 0;
 	int wchar_size = 2;
 	int le = 0;
 
 	/* utf-16 or utf-32? */
-	p = script;
-	assert(p >= script);
-	while ((size_t)(p-script) < script_size) {
-		p = memchr(p, 0, script_size-(p-script)-2);
+	while (offset < script_size && script_size - offset > 2) {
+		p = memchr(script + offset, 0, script_size - offset - 2);
 		if (!p) {
 			break;
 		}
@@ -349,13 +348,13 @@ static const zend_encoding *zend_multibyte_detect_utf_encoding(const unsigned ch
 		}
 
 		/* searching for UTF-32 specific byte orders, so this will do */
-		p += 4;
+		offset = p - script + 4;
 	}
 
 	/* BE or LE? */
-	p = script;
-	assert(p >= script);
-	while ((size_t)(p-script) < script_size) {
+	offset = 0;
+	while (script_size - offset >= (size_t) wchar_size) {
+		p = script + offset;
 		if (*p == '\0' && *(p+wchar_size-1) != '\0') {
 			/* BE */
 			le = 0;
@@ -365,7 +364,7 @@ static const zend_encoding *zend_multibyte_detect_utf_encoding(const unsigned ch
 			le = 1;
 			break;
 		}
-		p += wchar_size;
+		offset += wchar_size;
 	}
 
 	if (wchar_size == 2) {

ext/snmp/snmp.c

@@ -1158,7 +1158,8 @@ static bool snmp_session_set_contextEngineID(struct snmp_session *s, zend_string
 	size_t	ebuf_len = 32, eout_len = 0;
 	uint8_t	*ebuf = (uint8_t *) emalloc(ebuf_len);
 
-	if (!snmp_hex_to_binary(&ebuf, &ebuf_len, &eout_len, 1, ZSTR_VAL(contextEngineID))) {
+	/* Disallow reallocation: ebuf comes from emalloc() and net-snmp would realloc() it. */
+	if (!snmp_hex_to_binary(&ebuf, &ebuf_len, &eout_len, 0, ZSTR_VAL(contextEngineID))) {
 		zend_argument_value_error(context_engine_id_arg_num, "must be a valid context engine ID");
 		efree(ebuf);
 		return false;

ext/snmp/tests/gh23453.phpt

@@ -0,0 +1,19 @@
+--TEST--
+GH-23453 (SNMP::setSecurity() frees a non-malloced address with a context engine ID longer than 32 bytes)
+--EXTENSIONS--
+snmp
+--FILE--
+<?php
+$session = new SNMP(SNMP::VERSION_3, 'localhost', 'user');
+
+// 32 bytes is the maximum length of a context engine ID
+var_dump($session->setSecurity('authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345', 'myContext', str_repeat('aa', 32)));
+try {
+    var_dump($session->setSecurity('authPriv', 'SHA', 'authpassword12345', 'AES', 'privpassword12345', 'myContext', str_repeat('aa', 33)));
+} catch (\ValueError $e) {
+    echo $e::class, ': ', $e->getMessage(), \PHP_EOL;
+}
+?>
+--EXPECT--
+bool(true)
+ValueError: SNMP::setSecurity(): Argument #7 ($contextEngineId) must be a valid context engine ID

ext/uri/php_uri.c

@@ -1088,31 +1088,31 @@ PHP_FUNCTION(Uri_WhatWg_url_percent_encode)
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_Username:
 			ZEND_FALLTHROUGH;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_Password:
-			str = php_uri_parser_whatwg_percent_encode_userinfo_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_userinfo_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_OpaqueHost:
-			str = php_uri_parser_whatwg_percent_encode_opaque_host_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_opaque_host_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_Path:
-			str = php_uri_parser_whatwg_percent_encode_path_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_path_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_OpaquePath:
-			str = php_uri_parser_whatwg_percent_encode_opaque_path_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_opaque_path_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_PathSegment:
-			str = php_uri_parser_whatwg_percent_encode_path_segment_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_path_segment_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_Query:
-			str = php_uri_parser_whatwg_percent_encode_query_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_query_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_SpecialQuery:
-			str = php_uri_parser_whatwg_percent_encode_special_query_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_special_query_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_FormQuery:
-			str = php_uri_parser_whatwg_percent_encode_form_query_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_form_query_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		case ZEND_ENUM_Uri_WhatWg_UrlPercentEncodingMode_Fragment:
-			str = php_uri_parser_whatwg_percent_encode_fragment_component(ZSTR_VAL(input), ZSTR_LEN(input));
+			str = php_uri_parser_whatwg_fragment_percent_encode(ZSTR_VAL(input), ZSTR_LEN(input));
 			break;
 		default: ZEND_UNREACHABLE();
 	}
@@ -1216,7 +1216,7 @@ PHP_METHOD(Uri_Rfc3986_UriBuilder, setScheme)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("scheme"),
-		php_uri_parser_rfc3986_validate_scheme
+		php_uri_parser_rfc3986_scheme_validate
 	);
 }
 
@@ -1225,7 +1225,7 @@ PHP_METHOD(Uri_Rfc3986_UriBuilder, setUserInfo)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("userinfo"),
-		php_uri_parser_rfc3986_validate_userinfo
+		php_uri_parser_rfc3986_userinfo_validate
 	);
 }
 
@@ -1234,7 +1234,7 @@ PHP_METHOD(Uri_Rfc3986_UriBuilder, setHost)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("host"),
-		php_uri_parser_rfc3986_validate_host
+		php_uri_parser_rfc3986_host_validate
 	);
 }
 
@@ -1243,7 +1243,7 @@ PHP_METHOD(Uri_Rfc3986_UriBuilder, setPort)
 	php_uri_builder_set_component_long_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("port"),
-		php_uri_parser_rfc3986_validate_port
+		php_uri_parser_rfc3986_port_validate
 	);
 }
 
@@ -1252,7 +1252,7 @@ PHP_METHOD(Uri_Rfc3986_UriBuilder, setPath)
 	php_uri_builder_set_component_string(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("path"),
-		php_uri_parser_rfc3986_validate_path
+		php_uri_parser_rfc3986_path_validate
 	);
 }
 
@@ -1261,7 +1261,7 @@ PHP_METHOD(Uri_Rfc3986_UriBuilder, setQuery)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("query"),
-		php_uri_parser_rfc3986_validate_query
+		php_uri_parser_rfc3986_query_validate
 	);
 }
 
@@ -1270,7 +1270,7 @@ PHP_METHOD(Uri_Rfc3986_UriBuilder, setFragment)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("fragment"),
-		php_uri_parser_rfc3986_validate_fragment
+		php_uri_parser_rfc3986_fragment_validate
 	);
 }
 
@@ -1334,7 +1334,7 @@ PHP_METHOD(Uri_WhatWg_UrlBuilder, setScheme)
 	php_uri_builder_set_component_string(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("scheme"),
-		php_uri_parser_whatwg_validate_scheme
+		php_uri_parser_whatwg_scheme_validate
 	);
 }
 
@@ -1343,7 +1343,7 @@ PHP_METHOD(Uri_WhatWg_UrlBuilder, setUsername)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("username"),
-		php_uri_parser_whatwg_validate_none
+		php_uri_parser_whatwg_none_validate
 	);
 }
 
@@ -1352,7 +1352,7 @@ PHP_METHOD(Uri_WhatWg_UrlBuilder, setPassword)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("password"),
-		php_uri_parser_whatwg_validate_none
+		php_uri_parser_whatwg_none_validate
 	);
 }
 
@@ -1361,7 +1361,7 @@ PHP_METHOD(Uri_WhatWg_UrlBuilder, setHost)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("host"),
-		php_uri_parser_whatwg_validate_host
+		php_uri_parser_whatwg_host_validate
 	);
 }
 
@@ -1370,7 +1370,7 @@ PHP_METHOD(Uri_WhatWg_UrlBuilder, setPort)
 	php_uri_builder_set_component_long_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("port"),
-		php_uri_parser_whatwg_validate_port
+		php_uri_parser_whatwg_port_validate
 	);
 }
 
@@ -1379,7 +1379,7 @@ PHP_METHOD(Uri_WhatWg_UrlBuilder, setPath)
 	php_uri_builder_set_component_string(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("path"),
-		php_uri_parser_whatwg_validate_none
+		php_uri_parser_whatwg_none_validate
 	);
 }
 
@@ -1388,7 +1388,7 @@ PHP_METHOD(Uri_WhatWg_UrlBuilder, setQuery)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("query"),
-		php_uri_parser_whatwg_validate_none
+		php_uri_parser_whatwg_none_validate
 	);
 }
 
@@ -1397,7 +1397,7 @@ PHP_METHOD(Uri_WhatWg_UrlBuilder, setFragment)
 	php_uri_builder_set_component_string_or_null(
 		INTERNAL_FUNCTION_PARAM_PASSTHRU,
 		ZEND_STRL("fragment"),
-		php_uri_parser_whatwg_validate_none
+		php_uri_parser_whatwg_none_validate
 	);
 }
 

ext/uri/uri_parser_rfc3986.c

@@ -703,7 +703,7 @@ static zend_always_inline zend_result php_uri_parser_rfc3986_validate_component_
 	return FAILURE;
 }
 
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_scheme(const zend_string *scheme)
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_scheme_validate(const zend_string *scheme)
 {
 	const char *p = ZSTR_VAL(scheme);
 	const size_t len = ZSTR_LEN(scheme);
@@ -712,7 +712,7 @@ ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_scheme(const
 	return php_uri_parser_rfc3986_validate_component_result(well_formed, "scheme");
 }
 
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_userinfo(const zend_string *userinfo)
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_userinfo_validate(const zend_string *userinfo)
 {
 	const char *p = ZSTR_VAL(userinfo);
 	const size_t len = ZSTR_LEN(userinfo);
@@ -721,7 +721,7 @@ ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_userinfo(cons
 	return php_uri_parser_rfc3986_validate_component_result(well_formed, "userinfo");
 }
 
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_host(const zend_string *host)
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_host_validate(const zend_string *host)
 {
 	const char *p = ZSTR_VAL(host);
 	const size_t len = ZSTR_LEN(host);
@@ -758,7 +758,7 @@ ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_host(const ze
 	);
 }
 
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_port(const zend_long port)
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_port_validate(const zend_long port)
 {
 	char buf[MAX_LENGTH_OF_LONG + 1];
 	const char *res = zend_print_long_to_buf(buf + sizeof(buf) - 1, port);
@@ -768,7 +768,7 @@ ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_port(const ze
 	return php_uri_parser_rfc3986_validate_component_result(well_formed, "port");
 }
 
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_path(const zend_string *path)
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_path_validate(const zend_string *path)
 {
 	const char *p = ZSTR_VAL(path);
 	const size_t len = ZSTR_LEN(path);
@@ -779,7 +779,7 @@ ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_path(const ze
 	return php_uri_parser_rfc3986_validate_component_result(well_formed, "path");
 }
 
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_query(const zend_string *query)
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_query_validate(const zend_string *query)
 {
 	const char *p = ZSTR_VAL(query);
 	const size_t len = ZSTR_LEN(query);
@@ -788,7 +788,7 @@ ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_query(const z
 	return php_uri_parser_rfc3986_validate_component_result(well_formed, "query");
 }
 
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_fragment(const zend_string *fragment)
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_fragment_validate(const zend_string *fragment)
 {
 	const char *p = ZSTR_VAL(fragment);
 	const size_t len = ZSTR_LEN(fragment);

ext/uri/uri_parser_rfc3986.h

@@ -29,13 +29,13 @@ zend_result php_uri_parser_rfc3986_userinfo_write(php_uri_parser_rfc3986_uris *u
 
 php_uri_parser_rfc3986_uris *php_uri_parser_rfc3986_parse_ex(const char *uri_str, size_t uri_str_len, const php_uri_parser_rfc3986_uris *uriparser_base_url, bool silent);
 
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_scheme(const zend_string *scheme);
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_userinfo(const zend_string *userinfo);
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_host(const zend_string *host);
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_port(zend_long port);
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_path(const zend_string *path);
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_query(const zend_string *query);
-ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_validate_fragment(const zend_string *fragment);
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_scheme_validate(const zend_string *scheme);
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_userinfo_validate(const zend_string *userinfo);
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_host_validate(const zend_string *host);
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_port_validate(zend_long port);
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_path_validate(const zend_string *path);
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_query_validate(const zend_string *query);
+ZEND_ATTRIBUTE_NONNULL zend_result php_uri_parser_rfc3986_fragment_validate(const zend_string *fragment);
 
 ZEND_ATTRIBUTE_NONNULL_ARGS(2,3,4,5,6,7,8) php_uri_parser_rfc3986_uris *php_uri_parser_rfc3986_build_from_zval(
 	const php_uri_parser_rfc3986_uris *uriparser_base_uris,