Search
j0ke.net Open Build Service
>
Projects
>
internetx
:
php5
>
php-5.5.36
> php5-suhosin-php55.patch
Sign Up
|
Log In
Username
Password
Cancel
Overview
Repositories
Revisions
Requests
Users
Advanced
Attributes
Meta
File php5-suhosin-php55.patch of Package php-5.5.36
https://github.com/NewEraCracker/suhosin-patches/blob/master/patches/ext/suhosin.diff diff -uNr ext/suhosin/ex_imp.c ext/suhosin/ex_imp.c --- ext/suhosin/ex_imp.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/ex_imp.c Sat Apr 6 16:14:59 2013 @@ -727,7 +727,7 @@ /* {{{ suhosin_ex_imp_functions[] */ -function_entry suhosin_ex_imp_functions[] = { +zend_function_entry suhosin_ex_imp_functions[] = { PHP_NAMED_FE(extract, PHP_FN(suhosin_extract), suhosin_arginfo_extract) PHP_NAMED_FE(import_request_variables, PHP_FN(suhosin_import_request_variables), suhosin_arginfo_import_request_variables) {NULL, NULL, NULL} diff -uNr ext/suhosin/execute.c ext/suhosin/execute.c --- ext/suhosin/execute.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/execute.c Sat Apr 6 16:14:59 2013 @@ -35,21 +35,27 @@ #include "zend_compile.h" #include "zend_llist.h" #include "SAPI.h" +#include "main/php_version.h" #include "sha256.h" - +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 5) +#define IH_EXECUTE_INTERNAL_PARAMS zend_execute_data *execute_data_ptr, int return_value_used TSRMLS_DC +#define IH_EXECUTE_INTERNAL_PARAM_PASSTHRU execute_data_ptr, return_value_used TSRMLS_CC static void (*old_execute)(zend_op_array *op_array TSRMLS_DC); static void suhosin_execute(zend_op_array *op_array TSRMLS_DC); static void (*old_execute_ZO)(zend_op_array *op_array, long dummy TSRMLS_DC); static void suhosin_execute_ZO(zend_op_array *op_array, long dummy TSRMLS_DC); static void *(*zo_set_oe_ex)(void *ptr) = NULL; +#else +#define IH_EXECUTE_INTERNAL_PARAMS zend_execute_data *execute_data_ptr, zend_fcall_info *fci, int return_value_used TSRMLS_DC +#define IH_EXECUTE_INTERNAL_PARAM_PASSTHRU execute_data_ptr, fci, return_value_used TSRMLS_CC +static void (*old_execute_ex)(zend_execute_data *execute_data_ptr TSRMLS_DC); +static void suhosin_execute_ex(zend_execute_data *execute_data_ptr TSRMLS_DC); +#endif -/*STATIC zend_op_array* (*old_compile_file)(zend_file_handle* file_handle, int type TSRMLS_DC); - STATIC zend_op_array* suhosin_compile_file(zend_file_handle*, int TSRMLS_DC);*/ - -static void suhosin_execute_internal(zend_execute_data *execute_data_ptr, int return_value_used TSRMLS_DC); -static void (*old_execute_internal)(zend_execute_data *execute_data_ptr, int return_value_used TSRMLS_DC); +static void (*old_execute_internal)(IH_EXECUTE_INTERNAL_PARAMS); +static void suhosin_execute_internal(IH_EXECUTE_INTERNAL_PARAMS); extern zend_extension suhosin_zend_extension_entry; @@ -152,7 +158,7 @@ t = h = (h == NULL) ? h2 : ( (h2 == NULL) ? h : ( (h < h2) ? h : h2 ) ); if (h == NULL) break; - while (t > s && (isalnum(t[-1]) || t[-1]=='_')) { + while (t > s && (isalnum(t[-1]) || t[-1]=='_' || t[-1]=='.')) { t--; } @@ -195,7 +201,7 @@ t = h = (h == NULL) ? h2 : ( (h2 == NULL) ? h : ( (h < h2) ? h : h2 ) ); if (h == NULL) break; - while (t > s && (isalnum(t[-1]) || t[-1]=='_')) { + while (t > s && (isalnum(t[-1]) || t[-1]=='_' || t[-1]=='.')) { t--; } @@ -353,10 +359,16 @@ return SUHOSIN_CODE_TYPE_UNKNOWN; } -/* {{{ void suhosin_execute_ex(zend_op_array *op_array TSRMLS_DC) +/* {{{ void suhosin_execute_ex * This function provides a hook for execution */ +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 5) static void suhosin_execute_ex(zend_op_array *op_array, int zo, long dummy TSRMLS_DC) { +#else +static void suhosin_execute_ex(zend_execute_data *execute_data_ptr TSRMLS_DC) +{ + zend_op_array *op_array = execute_data_ptr->op_array; +#endif zend_op_array *new_op_array; int op_array_type, len; char *fn; @@ -579,17 +591,22 @@ } continue_execution: +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 5) if (zo) { old_execute_ZO (op_array, dummy TSRMLS_CC); } else { old_execute (op_array TSRMLS_CC); } +#else + old_execute_ex(execute_data_ptr TSRMLS_CC); +#endif /* nothing to do */ SUHOSIN_G(in_code_type) = orig_code_type; SUHOSIN_G(execution_depth)--; } /* }}} */ +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 5) /* {{{ void suhosin_execute(zend_op_array *op_array TSRMLS_DC) * This function provides a hook for execution */ static void suhosin_execute(zend_op_array *op_array TSRMLS_DC) @@ -604,11 +621,22 @@ suhosin_execute_ex(op_array, 1, dummy TSRMLS_CC); } /* }}} */ +#endif - +#if PHP_MAJOR_VERSION > 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 4) +#define IH_HANDLER_PARAMS_REST int ht, zval *return_value, zval **return_value_ptr, zval *this_ptr, int return_value_used TSRMLS_DC +#define IH_HANDLER_PARAMS internal_function_handler *ih, IH_HANDLER_PARAMS_REST +#define IH_HANDLER_PARAM_PASSTHRU ih, ht, *return_value_ptr, \ + (execute_data_ptr->function_state.function->common.fn_flags & ZEND_ACC_RETURN_REFERENCE)?return_value_ptr:NULL, \ + execute_data_ptr->object, return_value_used TSRMLS_CC +#if PHP_MAJOR_VERSION > 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 5) +#define IH_HANDLER_PARAM_FCI_PASSTHRU ih, fci->param_count, *fci->retval_ptr_ptr, fci->retval_ptr_ptr, fci->object_ptr, 1 TSRMLS_CC +#endif +#else #define IH_HANDLER_PARAMS_REST zend_execute_data *execute_data_ptr, int return_value_used, int ht, zval *return_value TSRMLS_DC #define IH_HANDLER_PARAMS internal_function_handler *ih, IH_HANDLER_PARAMS_REST #define IH_HANDLER_PARAM_PASSTHRU ih, execute_data_ptr, return_value_used, ht, return_value TSRMLS_CC +#endif HashTable ihandler_table; @@ -626,12 +654,20 @@ { zval **regex, **replace, - **subject, - **limit; + **subject; +#ifndef PHP_ATLEAST_5_3 + zval **limit; if (ZEND_NUM_ARGS() < 3 || zend_get_parameters_ex(3, ®ex, &replace, &subject, &limit) == FAILURE) { return (0); } +#else + long limit = -1; + zval **zcount = NULL; + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZZ|lZ", ®ex, &replace, &subject, &limit, &zcount) == FAILURE) { + return (1); + } +#endif if (Z_TYPE_PP(regex) == IS_ARRAY) { zval **regex_entry; @@ -1022,6 +1058,7 @@ return (0); } +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 4) static int suhosin_php_body_write(const char *str, uint str_length TSRMLS_DC) { #define P_META_ROBOTS "<meta name=\"ROBOTS\" content=\"NOINDEX,NOFOLLOW,NOARCHIVE\" />" @@ -1065,6 +1102,7 @@ RETVAL_TRUE; return (1); } +#endif static int ih_function_exists(IH_HANDLER_PARAMS) @@ -1072,35 +1110,34 @@ #ifndef PHP_ATLEAST_5_3 zval **function_name; #endif + char *name; + int name_len; zend_function *func; char *lcname; zend_bool retval; - int func_name_len; #ifndef PHP_ATLEAST_5_3 if (ZEND_NUM_ARGS()!=1 || zend_get_parameters_ex(1, &function_name)==FAILURE) { ZEND_WRONG_PARAM_COUNT_WITH_RETVAL(1); } convert_to_string_ex(function_name); - func_name_len = Z_STRLEN_PP(function_name); - lcname = estrndup(Z_STRVAL_PP(function_name), func_name_len); - zend_str_tolower(lcname, func_name_len); + name = Z_STRVAL_PP(function_name); + name_len = Z_STRLEN_PP(function_name); #else - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &lcname, &func_name_len) == FAILURE) { - return; + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &name, &name_len) == FAILURE) { + return (1); } +#endif + lcname = zend_str_tolower_dup(name, name_len); /* Ignore leading "\" */ - if (lcname[0] == '\\') { - lcname = &lcname[1]; - func_name_len--; + name = lcname; + if (name_len > 0 && lcname[0] == '\\') { + name = &lcname[1]; + name_len--; } - lcname = zend_str_tolower_dup(lcname, func_name_len); -#endif - retval = (zend_hash_find(EG(function_table), lcname, func_name_len+1, (void **)&func) == SUCCESS); - - efree(lcname); + retval = (zend_hash_find(EG(function_table), name, name_len+1, (void **)&func) == SUCCESS); /* * A bit of a hack, but not a bad one: we see if the handler of the function @@ -1114,26 +1151,28 @@ /* Now check if function is forbidden by Suhosin */ if (SUHOSIN_G(in_code_type) == SUHOSIN_EVAL) { if (SUHOSIN_G(eval_whitelist) != NULL) { - if (!zend_hash_exists(SUHOSIN_G(eval_whitelist), lcname, func_name_len+1)) { + if (!zend_hash_exists(SUHOSIN_G(eval_whitelist), name, name_len+1)) { retval = 0; } } else if (SUHOSIN_G(eval_blacklist) != NULL) { - if (zend_hash_exists(SUHOSIN_G(eval_blacklist), lcname, func_name_len+1)) { + if (zend_hash_exists(SUHOSIN_G(eval_blacklist), name, name_len+1)) { retval = 0; } } } if (SUHOSIN_G(func_whitelist) != NULL) { - if (!zend_hash_exists(SUHOSIN_G(func_whitelist), lcname, func_name_len+1)) { + if (!zend_hash_exists(SUHOSIN_G(func_whitelist), name, name_len+1)) { retval = 0; } } else if (SUHOSIN_G(func_blacklist) != NULL) { - if (zend_hash_exists(SUHOSIN_G(func_blacklist), lcname, func_name_len+1)) { + if (zend_hash_exists(SUHOSIN_G(func_blacklist), name, name_len+1)) { retval = 0; } } + efree(lcname); + RETVAL_BOOL(retval); return (1); } @@ -1344,7 +1383,7 @@ suhosin_SHA256Init(&context); suhosin_SHA256Update(&context, (void *) seedbuf, sizeof(php_uint32) * 8); - suhosin_SHA256Final(seedbuf, &context); + suhosin_SHA256Final((void *)seedbuf, &context); } /* }}} */ @@ -1501,7 +1540,7 @@ { #ifdef PHP_ATLEAST_5_3 if (zend_parse_parameters_none() == FAILURE) { - return; + return (1); } #else int argc = ZEND_NUM_ARGS(); @@ -1518,7 +1557,10 @@ { "preg_replace", ih_preg_replace, NULL, NULL, NULL }, { "mail", ih_mail, NULL, NULL, NULL }, { "symlink", ih_symlink, NULL, NULL, NULL }, + +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 4) { "phpinfo", ih_phpinfo, NULL, NULL, NULL }, +#endif { "srand", ih_srand, NULL, NULL, NULL }, { "mt_srand", ih_mt_srand, NULL, NULL, NULL }, @@ -1575,13 +1617,19 @@ #define FUNCTION_WARNING() zend_error(E_WARNING, "%s() has been disabled for security reasons", get_active_function_name(TSRMLS_C)); #define FUNCTION_SIMULATE_WARNING() zend_error(E_WARNING, "SIMULATION - %s() has been disabled for security reasons", get_active_function_name(TSRMLS_C)); -/* {{{ void suhosin_execute_internal(zend_execute_data *execute_data_ptr, int return_value_used TSRMLS_DC) +/* {{{ void suhosin_execute_internal * This function provides a hook for internal execution */ -static void suhosin_execute_internal(zend_execute_data *execute_data_ptr, int return_value_used TSRMLS_DC) +static void suhosin_execute_internal(IH_EXECUTE_INTERNAL_PARAMS) { char *lcname; int function_name_strlen, free_lcname = 0; + +#if PHP_MAJOR_VERSION > 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 4) + zval **return_value_ptr; +#else zval *return_value; +#endif + zend_class_entry *ce = NULL; int ht; internal_function_handler *ih; @@ -1605,13 +1653,6 @@ zend_str_tolower(lcname, function_name_strlen); } -#ifdef ZEND_ENGINE_2 - return_value = (*(temp_variable *)((char *) execute_data_ptr->Ts + execute_data_ptr->opline->result.u.var)).var.ptr; -#else - return_value = execute_data_ptr->Ts[execute_data_ptr->opline->result.u.var].var.ptr; -#endif - ht = execute_data_ptr->opline->extended_value; - SDEBUG("function: %s", lcname); if (SUHOSIN_G(in_code_type) == SUHOSIN_EVAL) { @@ -1663,14 +1704,30 @@ void *handler = ((zend_internal_function *) execute_data_ptr->function_state.function)->handler; if (handler != ZEND_FN(display_disabled_function)) { +#if PHP_MAJOR_VERSION > 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 5) + if(fci != NULL) { + retval = ih->handler(IH_HANDLER_PARAM_FCI_PASSTHRU); + } else { + return_value_ptr = &EX_TMP_VAR(execute_data_ptr, execute_data_ptr->opline->result.var)->var.ptr; +#elif (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION == 4) + return_value_ptr = &(*(temp_variable *)((char *) execute_data_ptr->Ts + execute_data_ptr->opline->result.var)).var.ptr; +#elif (PHP_MAJOR_VERSION == 5) + return_value = (*(temp_variable *)((char *) execute_data_ptr->Ts + execute_data_ptr->opline->result.u.var)).var.ptr; +#else + return_value = execute_data_ptr->Ts[execute_data_ptr->opline->result.u.var].var.ptr; +#endif + ht = execute_data_ptr->opline->extended_value; retval = ih->handler(IH_HANDLER_PARAM_PASSTHRU); +#if PHP_MAJOR_VERSION > 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 5) + } +#endif } if (retval == 0) { - old_execute_internal(execute_data_ptr, return_value_used TSRMLS_CC); + old_execute_internal(IH_EXECUTE_INTERNAL_PARAM_PASSTHRU); } } else { - old_execute_internal(execute_data_ptr, return_value_used TSRMLS_CC); + old_execute_internal(IH_EXECUTE_INTERNAL_PARAM_PASSTHRU); } if (free_lcname == 1) { efree(lcname); @@ -1686,6 +1743,7 @@ /* }}} */ +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 5) /* {{{ int function_lookup(zend_extension *extension) */ static int function_lookup(zend_extension *extension) @@ -1703,6 +1761,7 @@ return 0; } /* }}} */ +#endif /* {{{ void suhosin_hook_execute() @@ -1711,6 +1770,7 @@ { internal_function_handler *ih; +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 5) old_execute = zend_execute; zend_execute = suhosin_execute; @@ -1727,6 +1787,10 @@ if (zo_set_oe_ex != NULL) { old_execute_ZO = zo_set_oe_ex(suhosin_execute_ZO); } +#else + old_execute_ex = zend_execute_ex; + zend_execute_ex = suhosin_execute_ex; +#endif old_execute_internal = zend_execute_internal; if (old_execute_internal == NULL) { @@ -1761,11 +1825,15 @@ */ void suhosin_unhook_execute() { +#if PHP_MAJOR_VERSION < 5 || (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION < 5) if (zo_set_oe_ex) { zo_set_oe_ex(old_execute_ZO); } zend_execute = old_execute; +#else + zend_execute_ex = old_execute_ex; +#endif /* zend_compile_file = old_compile_file; */ diff -uNr ext/suhosin/ifilter.c ext/suhosin/ifilter.c --- ext/suhosin/ifilter.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/ifilter.c Sat Apr 6 16:14:59 2013 @@ -146,7 +146,7 @@ if (zend_hash_find(arr, key, klen, (void **) &tzval) == SUCCESS && Z_TYPE_PP(tzval) == IS_STRING) { - s = t = Z_STRVAL_PP(tzval); + s = t = (unsigned char *)Z_STRVAL_PP(tzval); for (; *t; t++) { if (suhosin_is_dangerous_char[*t]) { *t = '?'; @@ -168,7 +168,7 @@ if (zend_hash_find(arr, key, klen, (void **) &tzval) == SUCCESS && Z_TYPE_PP(tzval) == IS_STRING) { - temp = Z_STRVAL_PP(tzval); + temp = (unsigned char *)Z_STRVAL_PP(tzval); t = temp; for (t = temp; *t; t++) { @@ -195,7 +195,7 @@ } *n = 0; - Z_STRVAL_PP(tzval) = newv; + Z_STRVAL_PP(tzval) = (char *)newv; Z_STRLEN_PP(tzval) = n-newv; } } diff -uNr ext/suhosin/log.c ext/suhosin/log.c --- ext/suhosin/log.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/log.c Sat Apr 6 16:14:59 2013 @@ -31,11 +31,18 @@ #include "SAPI.h" #include "ext/standard/datetime.h" #include "ext/standard/flock_compat.h" +#include "main/php_version.h" #ifdef HAVE_SYS_SOCKET_H #include <sys/socket.h> #endif +#ifdef HAVE_SYS_TIME_H +#include <sys/time.h> +#elif defined(PHP_WIN32) +#include "win32/time.h" +#endif + #if defined(PHP_WIN32) || defined(__riscos__) || defined(NETWARE) #undef AF_UNIX #endif @@ -261,7 +268,11 @@ /* SAPI Logging activated? */ SDEBUG("(suhosin_log) log_syslog: %u - log_sapi: %u - log_script: %u - log_phpscript: %u", SUHOSIN_G(log_syslog), SUHOSIN_G(log_sapi), SUHOSIN_G(log_script), SUHOSIN_G(log_phpscript)); if (((SUHOSIN_G(log_sapi)|S_INTERNAL) & loglevel)!=0) { +#if PHP_VERSION_ID < 50400 sapi_module.log_message(buf); +#else + sapi_module.log_message(buf TSRMLS_CC); +#endif } /*log_script:*/ @@ -317,7 +328,9 @@ zval *result = NULL; long orig_execution_depth = SUHOSIN_G(execution_depth); +#if PHP_VERSION_ID < 50400 zend_bool orig_safe_mode = PG(safe_mode); +#endif char *orig_basedir = PG(open_basedir); char *phpscript = SUHOSIN_G(log_phpscriptname); @@ -354,14 +367,18 @@ SUHOSIN_G(execution_depth) = 0; if (SUHOSIN_G(log_phpscript_is_safe)) { +#if PHP_VERSION_ID < 50400 PG(safe_mode) = 0; +#endif PG(open_basedir) = NULL; } zend_execute(new_op_array TSRMLS_CC); SUHOSIN_G(execution_depth) = orig_execution_depth; +#if PHP_VERSION_ID < 50400 PG(safe_mode) = orig_safe_mode; +#endif PG(open_basedir) = orig_basedir; #ifdef ZEND_ENGINE_2 diff -uNr ext/suhosin/php_suhosin.h ext/suhosin/php_suhosin.h --- ext/suhosin/php_suhosin.h Thu Jan 19 15:49:18 2012 +++ ext/suhosin/php_suhosin.h Sat Apr 6 16:14:59 2013 @@ -186,6 +186,7 @@ int (*old_php_body_write)(const char *str, unsigned int str_length TSRMLS_DC); /* session */ + void *old_s_module; void *s_module; int (*old_s_read)(void **mod_data, const char *key, char **val, int *vallen TSRMLS_DC); int (*old_s_write)(void **mod_data, const char *key, const char *val, const int vallen TSRMLS_DC); @@ -308,7 +309,7 @@ char *suhosin_cookie_decryptor(TSRMLS_D); char *suhosin_getenv(char *name, size_t name_len TSRMLS_DC); void suhosin_hook_post_handlers(TSRMLS_D); -void suhosin_unhook_post_handlers(); +void suhosin_unhook_post_handlers(TSRMLS_D); void suhosin_hook_register_server_variables(); void suhosin_hook_header_handler(); void suhosin_unhook_header_handler(); diff -uNr ext/suhosin/post_handler.c ext/suhosin/post_handler.c --- ext/suhosin/post_handler.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/post_handler.c Sat Apr 6 16:14:59 2013 @@ -148,10 +148,10 @@ /* we need to tell suhosin patch that there is a new valid destructor */ /* therefore we have create HashTable that has this destructor */ - zend_hash_init(&tempht, 0, NULL, suhosin_post_handler_modification, 0); + zend_hash_init(&tempht, 0, NULL, (dtor_func_t)suhosin_post_handler_modification, 0); zend_hash_destroy(&tempht); /* And now we can overwrite the destructor for post entries */ - SG(known_post_content_types).pDestructor = suhosin_post_handler_modification; + SG(known_post_content_types).pDestructor = (dtor_func_t)suhosin_post_handler_modification; /* we have to stop mbstring from replacing our post handler */ if (zend_hash_find(EG(ini_directives), "mbstring.encoding_translation", sizeof("mbstring.encoding_translation"), (void **) &ini_entry) == FAILURE) { @@ -162,7 +162,7 @@ ini_entry->on_modify = suhosin_OnUpdate_mbstring_encoding_translation; } -void suhosin_unhook_post_handlers() +void suhosin_unhook_post_handlers(TSRMLS_D) { zend_ini_entry *ini_entry; @@ -186,5 +186,3 @@ * vim600: noet sw=4 ts=4 fdm=marker * vim<600: noet sw=4 ts=4 */ - - diff -uNr ext/suhosin/rfc1867.c ext/suhosin/rfc1867.c --- ext/suhosin/rfc1867.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/rfc1867.c Sat Apr 6 16:14:59 2013 @@ -35,6 +35,7 @@ #include "suhosin_rfc1867.h" #include "php_ini.h" #include "ext/standard/php_string.h" +#include "main/php_version.h" #define DEBUG_FILE_UPLOAD ZEND_DEBUG @@ -244,21 +245,29 @@ static void register_http_post_files_variable(char *strvar, char *val, zval *http_post_files, zend_bool override_protection TSRMLS_DC) { +#if PHP_VERSION_ID < 50400 int register_globals = PG(register_globals); PG(register_globals) = 0; +#endif safe_php_register_variable(strvar, val, http_post_files, override_protection TSRMLS_CC); +#if PHP_VERSION_ID < 50400 PG(register_globals) = register_globals; +#endif } static void register_http_post_files_variable_ex(char *var, zval *val, zval *http_post_files, zend_bool override_protection TSRMLS_DC) { +#if PHP_VERSION_ID < 50400 int register_globals = PG(register_globals); PG(register_globals) = 0; +#endif safe_php_register_variable_ex(var, val, http_post_files, override_protection TSRMLS_CC); +#if PHP_VERSION_ID < 50400 PG(register_globals) = register_globals; +#endif } /* @@ -1224,7 +1233,7 @@ if ((tmp = strrchr(filename, '/')) > s) { s = tmp; } -#ifdef PHP_WIN32 +#if defined(PHP_WIN32) && (PHP_VERSION_ID < 50400) if (PG(magic_quotes_gpc)) { s = s ? s : filename; tmp = strrchr(s, '\''); diff -uNr ext/suhosin/session.c ext/suhosin/session.c --- ext/suhosin/session.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/session.c Sat Apr 6 16:14:59 2013 @@ -33,6 +33,7 @@ #include "ext/standard/php_smart_str.h" #include "ext/standard/php_var.h" #include "sha256.h" +#include "main/php_version.h" #include <fcntl.h> @@ -233,9 +234,94 @@ zend_bool invalid_session_id; /* allows the driver to report about an invalid session id and request id regeneration */ } php_ps_globals_53; +#if PHP_VERSION_ID >= 50400 +typedef struct _php_session_rfc1867_progress_54 { + + size_t sname_len; + zval sid; + smart_str key; + + long update_step; + long next_update; + double next_update_time; + zend_bool cancel_upload; + zend_bool apply_trans_sid; + size_t content_length; + + zval *data; /* the array exported to session data */ + zval *post_bytes_processed; /* data["bytes_processed"] */ + zval *files; /* data["files"] array */ + zval *current_file; /* array of currently uploading file */ + zval *current_file_bytes_processed; +} php_session_rfc1867_progress_54; + +typedef struct _php_ps_globals_54 { + char *save_path; + char *session_name; + char *id; + char *extern_referer_chk; + char *entropy_file; + char *cache_limiter; + long entropy_length; + long cookie_lifetime; + char *cookie_path; + char *cookie_domain; + zend_bool cookie_secure; + zend_bool cookie_httponly; + ps_module *mod; + ps_module *default_mod; + void *mod_data; + php_session_status session_status; + long gc_probability; + long gc_divisor; + long gc_maxlifetime; + int module_number; + long cache_expire; + union { + zval *names[6]; + struct { + zval *ps_open; + zval *ps_close; + zval *ps_read; + zval *ps_write; + zval *ps_destroy; + zval *ps_gc; + } name; + } mod_user_names; + int mod_user_implemented; + int mod_user_is_open; + const struct ps_serializer_struct *serializer; + zval *http_session_vars; + zend_bool auto_start; + zend_bool use_cookies; + zend_bool use_only_cookies; + zend_bool use_trans_sid; /* contains the INI value of whether to use trans-sid */ + zend_bool apply_trans_sid; /* whether or not to enable trans-sid for the current request */ + + long hash_func; +#if defined(HAVE_HASH_EXT) && !defined(COMPILE_DL_HASH) + php_hash_ops *hash_ops; +#endif + long hash_bits_per_character; + int send_cookie; + int define_sid; + zend_bool invalid_session_id; /* allows the driver to report about an invalid session id and request id regeneration */ + + php_session_rfc1867_progress_54 *rfc1867_progress; + zend_bool rfc1867_enabled; /* session.upload_progress.enabled */ + zend_bool rfc1867_cleanup; /* session.upload_progress.cleanup */ + smart_str rfc1867_prefix; /* session.upload_progress.prefix */ + smart_str rfc1867_name; /* session.upload_progress.name */ + long rfc1867_freq; /* session.upload_progress.freq */ + double rfc1867_min_freq; /* session.upload_progress.min_freq */ +} php_ps_globals_54; +#endif + #ifdef ZTS static ts_rsrc_id session_globals_id = 0; -# if (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 3) +# if (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 4) +# define SESSION_G(v) TSRMG(session_globals_id, php_ps_globals_54 *, v) +# elif (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 3) # define SESSION_G(v) TSRMG(session_globals_id, php_ps_globals_53 *, v) # elif (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 2) # define SESSION_G(v) TSRMG(session_globals_id, php_ps_globals_52 *, v) @@ -247,7 +333,9 @@ UNSUPPORTED PHP VERSION # endif #else -# if (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 3) +# if (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 4) +static php_ps_globals_54 *session_globals = NULL; +# elif (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 3) static php_ps_globals_53 *session_globals = NULL; # elif (PHP_MAJOR_VERSION == 5 && PHP_MINOR_VERSION >= 2) static php_ps_globals_52 *session_globals = NULL; @@ -294,6 +382,7 @@ if (SESSION_G(http_session_vars) && SESSION_G(http_session_vars)->type == IS_ARRAY) { ret = zend_hash_find(Z_ARRVAL_P(SESSION_G(http_session_vars)), name, namelen + 1, (void **) state_var); +#if PHP_VERSION_ID < 50400 /* If register_globals is enabled, and * if there is an entry for the slot in $_SESSION, and * if that entry is still set to NULL, and @@ -307,6 +396,7 @@ *state_var = tmp; } } +#endif } return ret; } @@ -426,7 +516,7 @@ } /* store ip value */ - suhosin_get_ipv4(crypted+4 TSRMLS_CC); + suhosin_get_ipv4((char *)crypted+4 TSRMLS_CC); /* store check value */ crypted[8] = check & 0xff; @@ -544,7 +634,7 @@ if (check_ra > 4) { check_ra = 4; } - suhosin_get_ipv4(&buf TSRMLS_CC); + suhosin_get_ipv4(&buf[0] TSRMLS_CC); if (memcmp(buf, decrypted+4, check_ra) != 0) { goto error_out; } @@ -639,7 +729,12 @@ }*/ /* protect dumb session handlers */ - if (key == NULL || !key[0] || *mod_data == NULL) { + if (key == NULL || !key[0] || + (*mod_data == NULL +#if PHP_VERSION_ID >= 50400 + && !SESSION_G(mod_user_implemented) +#endif + )) { regenerate: SDEBUG("regenerating key is %s", key); KEY = SESSION_G(id) = SESSION_G(mod)->s_create_sid(&SESSION_G(mod_data), NULL TSRMLS_CC); @@ -688,7 +783,12 @@ char *v = (char *)val; /* protect dumb session handlers */ - if (key == NULL || !key[0] || val == NULL || strlen(key) > SUHOSIN_G(session_max_id_length) || *mod_data == NULL) { + if (key == NULL || !key[0] || val == NULL || strlen(key) > SUHOSIN_G(session_max_id_length) || + (*mod_data == NULL +#if PHP_VERSION_ID >= 50400 + && !SESSION_G(mod_user_implemented) +#endif + )) { r = FAILURE; goto return_write; } @@ -731,7 +831,12 @@ int r; /* protect dumb session handlers */ - if (key == NULL || !key[0] || strlen(key) > SUHOSIN_G(session_max_id_length) || *mod_data == NULL) { + if (key == NULL || !key[0] || strlen(key) > SUHOSIN_G(session_max_id_length) || + (*mod_data == NULL +#if PHP_VERSION_ID >= 50400 + && !SESSION_G(mod_user_implemented) +#endif + )) { return FAILURE; } @@ -763,15 +868,25 @@ SUHOSIN_G(old_s_destroy) = mod->s_destroy; mod->s_destroy = suhosin_hook_s_destroy; + SUHOSIN_G(old_s_module) = old_mod; SESSION_G(mod) = mod; } +static void suhosin_unhook_session_module(TSRMLS_D) +{ + ps_module *old_mod = SUHOSIN_G(old_s_module); + + if (old_mod != NULL) { + SESSION_G(mod) = old_mod; + } +} + static PHP_INI_MH(suhosin_OnUpdateSaveHandler) { int r; + suhosin_unhook_session_module(TSRMLS_C); r = old_OnUpdateSaveHandler(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC); - suhosin_hook_session_module(TSRMLS_C); return r; @@ -869,7 +984,7 @@ /* increase session identifier entropy */ if (SESSION_G(entropy_length) == 0 || SESSION_G(entropy_file) == NULL) { - +#ifndef PHP_WIN32 /* ensure that /dev/urandom exists */ int fd = VCWD_OPEN("/dev/urandom", O_RDONLY); if (fd >= 0) { @@ -877,6 +992,7 @@ SESSION_G(entropy_length) = 16; SESSION_G(entropy_file) = pestrdup("/dev/urandom", 1); } +#endif } } diff -uNr ext/suhosin/sha256.c ext/suhosin/sha256.c --- ext/suhosin/sha256.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/sha256.c Sat Apr 6 16:14:59 2013 @@ -86,9 +86,11 @@ return; } +#if PHP_VERSION_ID < 50400 if (PG(safe_mode) && (!php_checkuid(arg, NULL, CHECKUID_CHECK_FILE_AND_DIR))) { RETURN_FALSE; } +#endif if (php_check_open_basedir(arg TSRMLS_CC)) { RETURN_FALSE; @@ -392,7 +394,7 @@ /* {{{ suhosin_sha256_functions[] */ -static function_entry suhosin_sha256_functions[] = { +static zend_function_entry suhosin_sha256_functions[] = { PHP_NAMED_FE(sha256, PHP_FN(suhosin_sha256), NULL) PHP_NAMED_FE(sha256_file, PHP_FN(suhosin_sha256_file), NULL) {NULL, NULL, NULL} diff -uNr ext/suhosin/suhosin.c ext/suhosin/suhosin.c --- ext/suhosin/suhosin.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/suhosin.c Sat Apr 6 16:14:59 2013 @@ -32,8 +32,12 @@ #include "zend_llist.h" #include "zend_operators.h" #include "SAPI.h" + +#if PHP_VERSION_ID < 50500 #include "php_logos.h" #include "suhosin_logo.h" +#endif + #include "ext/standard/php_string.h" #include "ext/standard/url.h" #include "ext/standard/base64.h" @@ -189,9 +193,11 @@ static void suhosin_shutdown(zend_extension *extension) { + TSRMLS_FETCH(); + suhosin_unhook_execute(); suhosin_unhook_header_handler(); - suhosin_unhook_post_handlers(); + suhosin_unhook_post_handlers(TSRMLS_C); if (ze != NULL) { ze->startup = orig_module_startup; @@ -646,12 +652,16 @@ array_init(gpc_element); zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p); } else { +#if PHP_VERSION_ID < 50400 if (PG(magic_quotes_gpc) && (index != var)) { /* no need to addslashes() the index if it's the main variable name */ escaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC); } else { +#endif escaped_index = index; +#if PHP_VERSION_ID < 50400 } +#endif if (zend_symtable_find(symtable1, escaped_index, index_len + 1, (void **) &gpc_element_p) == FAILURE || Z_TYPE_PP(gpc_element_p) != IS_ARRAY) { MAKE_STD_ZVAL(gpc_element); @@ -683,11 +693,15 @@ if (!index) { zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p); } else { +#if PHP_VERSION_ID < 50400 if (PG(magic_quotes_gpc)) { escaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC); } else { +#endif escaped_index = index; +#if PHP_VERSION_ID < 50400 } +#endif /* * According to rfc2965, more specific paths are listed above the less specific ones. * If we encounter a duplicate cookie name, we should skip it, since it is not possible @@ -714,11 +728,15 @@ /* Prepare value */ Z_STRLEN(new_entry) = str_len; +#if PHP_VERSION_ID < 50400 if (PG(magic_quotes_gpc)) { Z_STRVAL(new_entry) = php_addslashes(strval, Z_STRLEN(new_entry), &Z_STRLEN(new_entry), 0 TSRMLS_CC); } else { +#endif Z_STRVAL(new_entry) = estrndup(strval, Z_STRLEN(new_entry)); +#if PHP_VERSION_ID < 50400 } +#endif Z_TYPE(new_entry) = IS_STRING; suhosin_register_cookie_variable(var, &new_entry, track_vars_array TSRMLS_CC); @@ -1100,8 +1118,10 @@ suhosin_hook_sha256(); suhosin_hook_ex_imp(); +#if PHP_VERSION_ID < 50500 /* register the logo for phpinfo */ php_register_info_logo(SUHOSIN_LOGO_GUID, "image/jpeg", suhosin_logo, sizeof(suhosin_logo)); +#endif #if PHP_MAJOR_VERSION < 5 php_error_docref(NULL TSRMLS_CC, E_ERROR, "Suhosin Extension is not designed to run with PHP 4 and below. Erroring Out."); @@ -1191,6 +1211,8 @@ PHP_MINFO_FUNCTION(suhosin) { php_info_print_box_start(0); + +#if PHP_VERSION_ID < 50500 if (!sapi_module.phpinfo_as_text) { if (PG(expose_php)) { PUTS("<a href=\"http://www.suhosin.org/\"><img border=\"0\" src=\""); @@ -1227,6 +1249,7 @@ PUTS("\" alt=\"Suhosin logo\" /></a>\n"); } while(0); } +#endif PUTS("This server is protected with the Suhosin Extension " SUHOSIN_EXT_VERSION); PUTS(!sapi_module.phpinfo_as_text?"<br /><br />":"\n\n"); if (sapi_module.phpinfo_as_text) { diff -uNr ext/suhosin/treat_data.c ext/suhosin/treat_data.c --- ext/suhosin/treat_data.c Thu Jan 19 15:49:18 2012 +++ ext/suhosin/treat_data.c Sat Apr 6 16:14:59 2013 @@ -194,7 +194,12 @@ void suhosin_hook_treat_data() { +#if PHP_VERSION_ID < 50400 sapi_register_treat_data(suhosin_treat_data); +#else + TSRMLS_FETCH(); + sapi_register_treat_data(suhosin_treat_data TSRMLS_CC); +#endif #ifdef ZEND_ENGINE_2 if (old_input_filter == NULL) { old_input_filter = sapi_module.input_filter;
