← Back to branch summary

~ubuntu-branches/ubuntu/hardy/php5/hardy-updates

« back to all changes in this revision

Viewing changes to debian/patches/CVE-2012-0781.patch

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2012-06-12 16:02:25 UTC
  • Revision ID: package-import@ubuntu.com-20120612160225-tn90mbpdmeov3dpd
Tags: 5.2.4-2ubuntu5.25
* SECURITY UPDATE: denial of service via invalid tidy objects
  - debian/patches/CVE-2012-0781.patch: track initialization in
    ext/tidy/tidy.c, added tests to ext/tidy/tests/004.phpt,
    ext/tidy/tests/bug54682.phpt.
  - CVE-2012-0781
* SECURITY UPDATE: denial of service or possible directory traversal via
  invalid filename.
  - debian/patches/CVE-2012-1172.patch: ensure brackets get closed in
    main/rfc1867.c, add test to tests/basic/bug55500.phpt.
  - CVE-2012-1172
* SECURITY UPDATE: improve php5-cgi query string parameter parsing
  - debian/patches/CVE-2012-233x.patch: improve parsing in
    sapi/cgi/cgi_main.c.
  - CVE-2012-2335
  - CVE-2012-2336

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/CVE-2012-0781.patch
 
1
Description: fix denial of service via invalid tidy objects
 
2
Origin: backport, http://svn.php.net/viewvc?view=revision&revision=323118
 
3
Origin: backport, http://svn.php.net/viewvc?view=revision&revision=322536
 
4
Bug: https://bugs.php.net/bug.php?id=54682
 
5
 
 
6
Index: php5-5.2.4/ext/tidy/tests/004.phpt
 
7
===================================================================
 
8
--- php5-5.2.4.orig/ext/tidy/tests/004.phpt     2004-05-19 04:45:23.000000000 -0400
 
9
+++ php5-5.2.4/ext/tidy/tests/004.phpt  2012-06-12 15:53:47.644997564 -0400
 
10
@@ -4,14 +4,28 @@
 
11
 <?php if (!extension_loaded("tidy")) print "skip"; ?>
 
12
 --FILE--
 
13
 <?php 
 
14
-       $a = tidy_parse_string("<HTML></HTML>");
 
15
-       tidy_diagnose($a);
 
16
-       echo tidy_get_error_buffer($a);
 
17
+$a = tidy_parse_string('<HTML></HTML>');
 
18
+var_dump(tidy_diagnose($a));
 
19
+echo tidy_get_error_buffer($a);
 
20
+
 
21
+$html = <<< HTML
 
22
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 3.2//EN">
 
23
+<html>
 
24
+<head><title>foo</title></head>
 
25
+<body><p>hello</p></body>
 
26
+</html>
 
27
+HTML;
 
28
+$a = tidy_parse_string($html);
 
29
+var_dump(tidy_diagnose($a));
 
30
+echo tidy_get_error_buffer($a);
 
31
 ?>
 
32
 --EXPECT--
 
33
-
 
34
+bool(true)
 
35
 line 1 column 1 - Warning: missing <!DOCTYPE> declaration
 
36
 line 1 column 7 - Warning: discarding unexpected </html>
 
37
 line 1 column 14 - Warning: inserting missing 'title' element
 
38
 Info: Document content looks like HTML 3.2
 
39
-3 warnings, 0 errors were found!
 
40
\ No newline at end of file
 
41
+3 warnings, 0 errors were found!
 
42
+bool(true)
 
43
+Info: Document content looks like HTML 3.2
 
44
+No warnings or errors were found.
 
45
Index: php5-5.2.4/ext/tidy/tidy.c
 
46
===================================================================
 
47
--- php5-5.2.4.orig/ext/tidy/tidy.c     2007-05-04 13:11:05.000000000 -0400
 
48
+++ php5-5.2.4/ext/tidy/tidy.c  2012-06-12 15:53:47.700997565 -0400
 
49
@@ -190,6 +190,7 @@
 
50
        TidyDoc     doc;
 
51
        TidyBuffer  *errbuf;
 
52
        unsigned int ref_count;
 
53
+       unsigned int initialized:1;
 
54
 };
 
55
 
 
56
 struct _PHPTidyObj {
 
57
@@ -598,6 +599,7 @@
 
58
                        intern->ptdoc = emalloc(sizeof(PHPTidyDoc));
 
59
                        intern->ptdoc->doc = tidyCreate();
 
60
                        intern->ptdoc->ref_count = 1;
 
61
+                       intern->ptdoc->initialized = 0;
 
62
                        intern->ptdoc->errbuf = emalloc(sizeof(TidyBuffer));
 
63
                        tidyBufInit(intern->ptdoc->errbuf);
 
64
 
 
65
@@ -937,7 +939,9 @@
 
66
                        return FAILURE;
 
67
                }
 
68
        }
 
69
-       
 
70
+
 
71
+       obj->ptdoc->initialized = 1;
 
72
+
 
73
        tidyBufInit(&buf);
 
74
        tidyBufAppend(&buf, string, len);
 
75
        if (tidyParseBuffer(obj->ptdoc->doc, &buf) < 0) {
 
76
@@ -1185,7 +1189,7 @@
 
77
 {
 
78
        TIDY_FETCH_OBJECT;
 
79
 
 
80
-       if (tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
 
81
+       if (obj->ptdoc->initialized && tidyRunDiagnostics(obj->ptdoc->doc) >= 0) {
 
82
                tidy_doc_update_properties(obj TSRMLS_CC);
 
83
                RETURN_TRUE;
 
84
        }