Skip to content

Commit

Permalink
Fix GH-17797: zend_test_compile_string crash on invalid script path.
Browse files Browse the repository at this point in the history
When looking for the last slash of the script path, it leads to
underflow being promoted to SIZE_MAX being way beyond MAXPATHLEN.
  • Loading branch information
devnexen committed Feb 14, 2025
1 parent a54af45 commit 9ac3ac1
Show file tree
Hide file tree
Showing 2 changed files with 33 additions and 1 deletion.
31 changes: 31 additions & 0 deletions ext/zend_test/tests/gh17797.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
--TEST--
GH-17797 (zend_test_compile_string crash on invalid script path)
--EXTENSIONS--
zend_test
--CREDITS--
YuanchengJiang
--FILE--
<?php
$source = '<?php
require("sumfile.php");
?>';
try {zend_test_compile_string($source,$source,$c);} catch (Exception $e) { echo($e); }
--EXPECTF--

Warning: Undefined variable $c in %s on line %d

Deprecated: zend_test_compile_string(): Passing null to parameter #3 ($position) of type int is deprecated in %s on line %d

Warning: require(sumfile.php): Failed to open stream: No such file or directory in <?php
require("sumfile.php");
?> on line %d

Fatal error: Uncaught Error: Failed opening required 'sumfile.php' (include_path='.:') in <?php
require("sumfile.php");
?>:%d
Stack trace:
#0 %s(%d): zend_test_compile_string('<?php\nrequire("...', '<?php\nrequire("...', NULL)
#1 {main}
thrown in <?php
require("sumfile.php");
?> on line %d
3 changes: 2 additions & 1 deletion main/fopen_wrappers.c
Original file line number Diff line number Diff line change
Expand Up @@ -603,7 +603,8 @@ PHPAPI zend_string *php_resolve_path(const char *filename, size_t filename_lengt
const char *exec_fname = ZSTR_VAL(exec_filename);
size_t exec_fname_length = ZSTR_LEN(exec_filename);

while ((--exec_fname_length < SIZE_MAX) && !IS_SLASH(exec_fname[exec_fname_length]));
while (exec_fname_length != 0 && !IS_SLASH(exec_fname[--exec_fname_length]));

if (exec_fname_length > 0 &&
filename_length < (MAXPATHLEN - 2) &&
exec_fname_length + 1 + filename_length + 1 < MAXPATHLEN) {
Expand Down

0 comments on commit 9ac3ac1

Please sign in to comment.