Skip to content

bug fixes #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MarsAuthority wants to merge 2 commits into
base: master
Choose a base branch
from
Open

bug fixes #17

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
942f2a9
bug fixes
MarsAuthority Nov 16, 2014
e59dcb6
Bug fixes
MarsAuthority Nov 17, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 44 additions & 1 deletion taint.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1809,7 +1809,11 @@ static void php_taint_fcall_check(ZEND_OPCODE_HANDLER_ARGS, zend_op *opline, cha
|| strncmp("sqlite_query", fname, len) == 0
|| strncmp("sqlite_single_query", fname, len) == 0 ) {
zval *el;
el = *((zval **) (p - arg_count));
if(strncmp("mysqli_query", fname, len) == 0){
el = *((zval **) (p - arg_count + 1));
}else{
el = *((zval **) (p - arg_count));
}
if (el && IS_STRING == Z_TYPE_P(el) && PHP_TAINT_POSSIBLE(el)) {
php_taint_error(NULL TSRMLS_CC, "SQL statement contains data that might be tainted");
}
Expand Down Expand Up @@ -2058,6 +2062,44 @@ static int php_taint_assign_ref_handler(ZEND_OPCODE_HANDLER_ARGS) /* {{{ */ {

return ZEND_USER_OPCODE_DISPATCH;
} /* }}} */

static int php_taint_return_handler(ZEND_OPCODE_HANDLER_ARGS) /* {{{ */ {
zend_op *opline = execute_data->opline;
zval **op1 = NULL;
switch (TAINT_OP1_TYPE(opline)) {
case IS_VAR:
op1 = TAINT_T(TAINT_OP1_VAR(opline)).var.ptr_ptr;
break;
case IS_CV:
{
zval **t = TAINT_CV_OF(TAINT_OP1_VAR(opline));
if (t && *t) {
op1 = t;
} else if (EG(active_symbol_table)) {
zend_compiled_variable *cv = &TAINT_CV_DEF_OF(TAINT_OP1_VAR(opline));
if (zend_hash_quick_find(EG(active_symbol_table), cv->name, cv->name_len + 1, cv->hash_value, (void **)&t) == SUCCESS) {
op1 = t;
}
}
}
break;
}
if (!op1 || *op1 == &EG(error_zval) || *op1 == &EG(uninitialized_zval) || IS_STRING != Z_TYPE_PP(op1)
|| !PZVAL_IS_REF(*op1) || Z_REFCOUNT_PP(op1) < 2 || !Z_STRLEN_PP(op1) || !PHP_TAINT_POSSIBLE(*op1)) {
return ZEND_USER_OPCODE_DISPATCH;
}
if(op1 && PZVAL_IS_REF(*op1) && PHP_TAINT_POSSIBLE(*op1)) {
zval *ret;
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, *op1);
zval_copy_ctor(ret);

@laruence laruence Nov 17, 2014

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这块并没有给新得到的zval分配taint标记啊?

@MarsAuthority MarsAuthority Nov 17, 2014

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

不好意思，这块忘了，一会儿加上。

@MarsAuthority MarsAuthority Nov 17, 2014

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

之前上传的未同步...现在的刚刚测试了没问题，麻烦鸟哥看看。

Z_STRVAL_P(ret) = erealloc(Z_STRVAL_P(ret), Z_STRLEN_P(ret) + 1 + PHP_TAINT_MAGIC_LENGTH);
PHP_TAINT_MARK(ret, PHP_TAINT_MAGIC_POSSIBLE);
*EG(return_value_ptr_ptr) = ret;
}
return ZEND_USER_OPCODE_RETURN;

}/* }}} */

static int php_taint_send_ref_handler(ZEND_OPCODE_HANDLER_ARGS) /* {{{ */ {
zend_op *opline = execute_data->opline;
Expand Down Expand Up @@ -2183,6 +2225,7 @@ static void php_taint_register_handlers(TSRMLS_D) /* {{{ */ {
zend_set_user_opcode_handler(ZEND_ASSIGN, php_taint_assign_handler);
zend_set_user_opcode_handler(ZEND_SEND_VAR, php_taint_send_var_handler);
zend_set_user_opcode_handler(ZEND_SEND_REF, php_taint_send_ref_handler);
zend_set_user_opcode_handler(ZEND_RETURN, php_taint_return_handler);
#if (PHP_MAJOR_VERSION == 5) && (PHP_MINOR_VERSION < 4)
zend_set_user_opcode_handler(ZEND_QM_ASSIGN, php_taint_qm_assign_handler);
#endif
Expand Down