| 1 | From 4f22b2e70fab86ec620169d8e19477c991bf9cc1 Mon Sep 17 00:00:00 2001
|
| 2 | From: Ilia Alshanetsky <[email protected]>
|
| 3 | Date: Wed, 29 Jul 2026 11:21:50 -0400
|
| 4 | Subject: [PATCH 10/13] Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in
|
| 5 | FILTER_SANITIZE_ENCODED
|
| 6 |
|
| 7 | php_filter_encode_url() initialized its 256-byte "must encode" table with
|
| 8 | memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] uninitialized. Whether
|
| 9 | 0xFF got percent-encoded then depended on stack garbage; valgrind reports
|
| 10 | the read as a conditional jump on an uninitialised value. Initialize the
|
| 11 | whole table.
|
| 12 |
|
| 13 | Backport of 56149186d81469fd7fb2f8444359ee81dd4a70f4 from PHP-8.4.
|
| 14 |
|
| 15 | (cherry picked from commit 7ac9700d0d46a7b96e72e330efd295a3332124b0)
|
| 16 | ---
|
| 17 | ext/filter/sanitizing_filters.c | 2 +-
|
| 18 | ext/filter/tests/filter_sanitize_encoded_0xff.phpt | 12 ++++++++++++
|
| 19 | 2 files changed, 13 insertions(+), 1 deletion(-)
|
| 20 | create mode 100644 ext/filter/tests/filter_sanitize_encoded_0xff.phpt
|
| 21 |
|
| 22 | diff --git a/ext/filter/sanitizing_filters.c b/ext/filter/sanitizing_filters.c
|
| 23 | index 7c57171e9e8..27706ae9183 100644
|
| 24 | |
| 25 | |
| 26 | @@ -67,7 +67,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const
|
| 27 | unsigned char *e = s + char_len;
|
| 28 | zend_string *str;
|
| 29 |
|
| 30 | - memset(tmp, 1, sizeof(tmp)-1);
|
| 31 | + memset(tmp, 1, sizeof(tmp));
|
| 32 |
|
| 33 | while (s < e) {
|
| 34 | tmp[*s++] = '\0';
|
| 35 | diff --git a/ext/filter/tests/filter_sanitize_encoded_0xff.phpt b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt
|
| 36 | new file mode 100644
|
| 37 | index 00000000000..1ee61aba7b7
|
| 38 | |
| 39 | |
| 40 | @@ -0,0 +1,12 @@
|
| 41 | +--TEST--
|
| 42 | +FILTER_SANITIZE_ENCODED percent-encodes 0xFF
|
| 43 | +--EXTENSIONS--
|
| 44 | +filter
|
| 45 | +--FILE--
|
| 46 | +<?php
|
| 47 | +var_dump(filter_var("\xFF", FILTER_SANITIZE_ENCODED));
|
| 48 | +var_dump(filter_var("\xFE\xFF\x00A", FILTER_SANITIZE_ENCODED));
|
| 49 | +?>
|
| 50 | +--EXPECT--
|
| 51 | +string(3) "%FF"
|
| 52 | +string(10) "%FE%FF%00A"
|