From c8bb7630d58b305218fc7cab56bff073772d60c8 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Thu, 16 Jul 2026 07:25:58 -0400 Subject: [PATCH] ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED php_filter_encode_url initialized the "must encode" bitmap with memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] unset. On common stacks that byte stayed zero, so 0xFF was copied through unencoded. Initialize the full 256-byte table so every non-allowlisted byte is percent-encoded. --- ext/filter/sanitizing_filters.c | 2 +- ext/filter/tests/filter_sanitize_encoded_0xff.phpt | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 ext/filter/tests/filter_sanitize_encoded_0xff.phpt diff --git a/ext/filter/sanitizing_filters.c b/ext/filter/sanitizing_filters.c index 647d559c1df5..a356722765be 100644 --- a/ext/filter/sanitizing_filters.c +++ b/ext/filter/sanitizing_filters.c @@ -68,7 +68,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const unsigned char *e = s + char_len; zend_string *str; - memset(tmp, 1, sizeof(tmp)-1); + memset(tmp, 1, sizeof(tmp)); while (s < e) { tmp[*s++] = '\0'; diff --git a/ext/filter/tests/filter_sanitize_encoded_0xff.phpt b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt new file mode 100644 index 000000000000..1ee61aba7b70 --- /dev/null +++ b/ext/filter/tests/filter_sanitize_encoded_0xff.phpt @@ -0,0 +1,12 @@ +--TEST-- +FILTER_SANITIZE_ENCODED percent-encodes 0xFF +--EXTENSIONS-- +filter +--FILE-- + +--EXPECT-- +string(3) "%FF" +string(10) "%FE%FF%00A"