Skip to content

Commit 783ecad

Browse files
ndosschendossche
committed
Fix crashes in enchant when passing null bytes
See php#17393 (comment) Closes phpGH-17407.
1 parent 1235c74 commit 783ecad

File tree

3 files changed

+84
-11
lines changed

3 files changed

+84
-11
lines changed

‎NEWS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.3.17
44

5+
- Enchant:
6+
. Fix crashes in enchant when passing null bytes. (nielsdos)
7+
58
- FTP:
69
. Fixed bug GH-16800 (ftp functions can abort with EINTR). (nielsdos)
710

‎ext/enchant/enchant.c‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -339,7 +339,7 @@ PHP_FUNCTION(enchant_broker_set_dict_path)
339339
char *value;
340340
size_t value_len;
341341

342-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Ols", &broker, enchant_broker_ce, &dict_type, &value, &value_len) == FAILURE) {
342+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Olp", &broker, enchant_broker_ce, &dict_type, &value, &value_len) == FAILURE) {
343343
RETURN_THROWS();
344344
}
345345

@@ -440,7 +440,7 @@ PHP_FUNCTION(enchant_broker_request_dict)
440440
char *tag;
441441
size_t taglen;
442442

443-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os", &broker, enchant_broker_ce, &tag, &taglen) == FAILURE) {
443+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op", &broker, enchant_broker_ce, &tag, &taglen) == FAILURE) {
444444
RETURN_THROWS();
445445
}
446446

@@ -534,7 +534,7 @@ PHP_FUNCTION(enchant_broker_dict_exists)
534534
size_t taglen;
535535
enchant_broker * pbroker;
536536

537-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os", &broker, enchant_broker_ce, &tag, &taglen) == FAILURE) {
537+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op", &broker, enchant_broker_ce, &tag, &taglen) == FAILURE) {
538538
RETURN_THROWS();
539539
}
540540

@@ -559,7 +559,7 @@ PHP_FUNCTION(enchant_broker_set_ordering)
559559
size_t ptaglen;
560560
enchant_broker * pbroker;
561561

562-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Oss", &broker, enchant_broker_ce, &ptag, &ptaglen, &pordering, &porderinglen) == FAILURE) {
562+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Opp", &broker, enchant_broker_ce, &ptag, &ptaglen, &pordering, &porderinglen) == FAILURE) {
563563
RETURN_THROWS();
564564
}
565565

@@ -597,7 +597,7 @@ PHP_FUNCTION(enchant_dict_quick_check)
597597
size_t wordlen;
598598
enchant_dict *pdict;
599599

600-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os|z", &dict, enchant_dict_ce, &word, &wordlen, &sugg) == FAILURE) {
600+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op|z", &dict, enchant_dict_ce, &word, &wordlen, &sugg) == FAILURE) {
601601
RETURN_THROWS();
602602
}
603603

@@ -642,7 +642,7 @@ PHP_FUNCTION(enchant_dict_check)
642642
size_t wordlen;
643643
enchant_dict *pdict;
644644

645-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
645+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
646646
RETURN_THROWS();
647647
}
648648

@@ -662,7 +662,7 @@ PHP_FUNCTION(enchant_dict_suggest)
662662
enchant_dict *pdict;
663663
size_t n_sugg;
664664

665-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
665+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
666666
RETURN_THROWS();
667667
}
668668

@@ -690,7 +690,7 @@ PHP_FUNCTION(enchant_dict_add)
690690
size_t wordlen;
691691
enchant_dict *pdict;
692692

693-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
693+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
694694
RETURN_THROWS();
695695
}
696696

@@ -708,7 +708,7 @@ PHP_FUNCTION(enchant_dict_add_to_session)
708708
size_t wordlen;
709709
enchant_dict *pdict;
710710

711-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
711+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
712712
RETURN_THROWS();
713713
}
714714

@@ -726,7 +726,7 @@ PHP_FUNCTION(enchant_dict_is_added)
726726
size_t wordlen;
727727
enchant_dict *pdict;
728728

729-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Os", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
729+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Op", &dict, enchant_dict_ce, &word, &wordlen) == FAILURE) {
730730
RETURN_THROWS();
731731
}
732732

@@ -748,7 +748,7 @@ PHP_FUNCTION(enchant_dict_store_replacement)
748748

749749
enchant_dict *pdict;
750750

751-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Oss", &dict, enchant_dict_ce, &mis, &mislen, &cor, &corlen) == FAILURE) {
751+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "Opp", &dict, enchant_dict_ce, &mis, &mislen, &cor, &corlen) == FAILURE) {
752752
RETURN_THROWS();
753753
}
754754

‎ext/enchant/tests/null_bytes.phpt‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
--TEST--
2+
null bytes
3+
--EXTENSIONS--
4+
enchant
5+
--SKIPIF--
6+
<?php
7+
$broker = enchant_broker_init();
8+
if (!enchant_broker_list_dicts($broker)) die("skip No broker dicts installed");
9+
?>
10+
--FILE--
11+
<?php
12+
13+
$broker = enchant_broker_init();
14+
$dicts = enchant_broker_list_dicts($broker);
15+
$requestDict = enchant_broker_request_dict($broker, $dicts[0]['lang_tag']);
16+
17+
$two_params_broker = [
18+
"enchant_broker_request_dict",
19+
"enchant_broker_dict_exists",
20+
];
21+
22+
$two_params_dict = [
23+
"enchant_dict_quick_check",
24+
"enchant_dict_check",
25+
"enchant_dict_suggest",
26+
"enchant_dict_add",
27+
"enchant_dict_add_to_session",
28+
"enchant_dict_is_added",
29+
];
30+
31+
foreach ($two_params_broker as $func) {
32+
try {
33+
$func($broker, "foo\0bar");
34+
} catch (ValueError $e) {
35+
echo $e->getMessage(), "\n";
36+
}
37+
}
38+
39+
foreach ($two_params_dict as $func) {
40+
try {
41+
$func($requestDict, "foo\0bar");
42+
} catch (ValueError $e) {
43+
echo $e->getMessage(), "\n";
44+
}
45+
}
46+
47+
try {
48+
var_dump(enchant_broker_set_ordering($broker, "foo\0bar", "foo\0bar"));
49+
} catch (ValueError $e) {
50+
echo $e->getMessage(), "\n";
51+
}
52+
53+
try {
54+
var_dump(enchant_dict_store_replacement($requestDict, "foo\0bar", "foo\0bar"));
55+
} catch (ValueError $e) {
56+
echo $e->getMessage(), "\n";
57+
}
58+
59+
?>
60+
--EXPECT--
61+
enchant_broker_request_dict(): Argument #2 ($tag) must not contain any null bytes
62+
enchant_broker_dict_exists(): Argument #2 ($tag) must not contain any null bytes
63+
enchant_dict_quick_check(): Argument #2 ($word) must not contain any null bytes
64+
enchant_dict_check(): Argument #2 ($word) must not contain any null bytes
65+
enchant_dict_suggest(): Argument #2 ($word) must not contain any null bytes
66+
enchant_dict_add(): Argument #2 ($word) must not contain any null bytes
67+
enchant_dict_add_to_session(): Argument #2 ($word) must not contain any null bytes
68+
enchant_dict_is_added(): Argument #2 ($word) must not contain any null bytes
69+
enchant_broker_set_ordering(): Argument #2 ($tag) must not contain any null bytes
70+
enchant_dict_store_replacement(): Argument #2 ($misspelled) must not contain any null bytes

0 commit comments

Comments
 (0)