ext/standard: reject a dechunk chunk size that overflows size_t

ext/ftp/tests/server.inc

@@ -290,7 +290,7 @@ if ($pid) {
             }
 
             if (empty($m[1]) || $m[1] !== 'emptydir') {
-                fputs($fs, "file1\r\nfile1\r\nfile\nb0rk\r\n");
+                fputs($fs, $nlst_data ?? "file1\r\nfile1\r\nfile\nb0rk\r\n");
             }
 
             fputs($s, "226 Closing data Connection.\r\n");

ext/odbc/php_odbc.c

@@ -2217,9 +2217,9 @@ bool odbc_sqlconnect(zval *zv, char *db, char *uid, char *pwd, int cur_opt, bool
 
 			/* Force UID and PWD to be set in the DSN */
 			if (use_uid_arg || use_pwd_arg) {
-				db_end--;
-				if ((unsigned char)*(db_end) == ';') {
-					*db_end = '\0';
+				size_t base_len = db_len;
+				if (base_len > 0 && db[base_len - 1] == ';') {
+					base_len--;
 				}
 
 				char *uid_quoted = NULL, *pwd_quoted = NULL;
@@ -2235,7 +2235,7 @@ bool odbc_sqlconnect(zval *zv, char *db, char *uid, char *pwd, int cur_opt, bool
 					}
 
 					if (!use_pwd_arg) {
-						spprintf(&ldb, 0, "%s;UID=%s;", db, uid_quoted);
+						spprintf(&ldb, 0, "%.*s;UID=%s;", (int) base_len, db, uid_quoted);
 					}
 				}
 
@@ -2250,12 +2250,12 @@ bool odbc_sqlconnect(zval *zv, char *db, char *uid, char *pwd, int cur_opt, bool
 					}
 
 					if (!use_uid_arg) {
-						spprintf(&ldb, 0, "%s;PWD=%s;", db, pwd_quoted);
+						spprintf(&ldb, 0, "%.*s;PWD=%s;", (int) base_len, db, pwd_quoted);
 					}
 				}
 
 				if (use_uid_arg && use_pwd_arg) {
-					spprintf(&ldb, 0, "%s;UID=%s;PWD=%s;", db, uid_quoted, pwd_quoted);
+					spprintf(&ldb, 0, "%.*s;UID=%s;PWD=%s;", (int) base_len, db, uid_quoted, pwd_quoted);
 				}
 
 				if (uid_quoted && should_quote_uid) {

ext/odbc/tests/gh_odbc_dsn_immutability.phpt

@@ -0,0 +1,20 @@
+--TEST--
+odbc_connect() must not mutate the caller's DSN string
+--EXTENSIONS--
+odbc
+--FILE--
+<?php
+/* The '=' selects the connection-string form and the trailing ';' is what the
+ * UID/PWD assembly used to overwrite with a NUL, in the caller's own buffer. */
+$dsn = 'Driver=DoesNotExist;Database=x;SS001;';
+const DSN_CONST = 'Driver=DoesNotExist;Database=x;SS001_CONST;';
+
+@odbc_connect($dsn, 'u', 'p');
+@odbc_connect(DSN_CONST, 'u', 'p');
+
+var_dump($dsn);
+var_dump(DSN_CONST);
+?>
+--EXPECT--
+string(37) "Driver=DoesNotExist;Database=x;SS001;"
+string(43) "Driver=DoesNotExist;Database=x;SS001_CONST;"

ext/soap/php_http.c

@@ -956,14 +956,14 @@ int make_http_soap_request(zval        *this_ptr,
 				if (tmp != NULL) {
 					tmp++;
 					http_status = atoi(tmp);
-				}
-				tmp = strstr(tmp," ");
-				if (tmp != NULL) {
-					tmp++;
-					if (http_msg) {
-						efree(http_msg);
+					tmp = strstr(tmp," ");
+					if (tmp != NULL) {
+						tmp++;
+						if (http_msg) {
+							efree(http_msg);
+						}
+						http_msg = estrdup(tmp);
 					}
-					http_msg = estrdup(tmp);
 				}
 				efree(http_version);
 

ext/soap/tests/http_status_line_no_code.phpt

@@ -0,0 +1,33 @@
+--TEST--
+SoapClient: malformed HTTP status line without status code must not crash
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+$serverCode = <<<'CODE'
+$server = stream_socket_server("tcp://127.0.0.1:0", $errno, $errstr);
+phpt_notify_server_start($server);
+$conn = stream_socket_accept($server);
+while (($line = fgets($conn)) !== false) {
+	if ($line === "\r\n" || $line === "\n") {
+		break;
+	}
+}
+fwrite($conn, "HTTP/1.1\r\nContent-Type: text/xml\r\nContent-Length: 0\r\n\r\n");
+fclose($conn);
+CODE;
+
+$clientCode = <<<'CODE'
+$client = new SoapClient(null, [
+	'location' => 'http://{{ ADDR }}',
+	'uri' => 'http://testuri.org',
+	'connection_timeout' => 3,
+]);
+var_dump($client->__doRequest('<x/>', 'http://{{ ADDR }}', 'T', 1));
+CODE;
+
+include sprintf('%s/../../openssl/tests/ServerClientTestCase.inc', __DIR__);
+ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+?>
+--EXPECT--
+string(0) ""

ext/standard/filters.c

@@ -1715,19 +1715,26 @@ static size_t php_dechunk(char *buf, size_t len, php_chunked_filter_data *data)
 				data->chunk_size = 0;
 			case CHUNK_SIZE:
 				while (p < end) {
+					size_t digit;
+
 					if (*p >= '0' && *p <= '9') {
-						data->chunk_size = (data->chunk_size * 16) + (*p - '0');
+						digit = *p - '0';
 					} else if (*p >= 'A' && *p <= 'F') {
-						data->chunk_size = (data->chunk_size * 16) + (*p - 'A' + 10);
+						digit = *p - 'A' + 10;
 					} else if (*p >= 'a' && *p <= 'f') {
-						data->chunk_size = (data->chunk_size * 16) + (*p - 'a' + 10);
+						digit = *p - 'a' + 10;
 					} else if (data->state == CHUNK_SIZE_START) {
 						data->state = CHUNK_ERROR;
 						break;
 					} else {
 						data->state = CHUNK_SIZE_EXT;
 						break;
 					}
+					if (data->chunk_size > (SIZE_MAX / 16)) {
+						data->state = CHUNK_ERROR;
+						break;
+					}
+					data->chunk_size = (data->chunk_size * 16) + digit;
 					data->state = CHUNK_SIZE;
 					p++;
 				}

ext/standard/ftp_fopen_wrapper.c

@@ -625,9 +625,9 @@ static ssize_t php_ftp_dirstream_read(php_stream *stream, char *buf, size_t coun
 
 	basename = php_basename(ent->d_name, tmp_len, NULL, 0);
 
-	tmp_len = MIN(sizeof(ent->d_name), ZSTR_LEN(basename) - 1);
+	tmp_len = MIN(sizeof(ent->d_name) - 1, ZSTR_LEN(basename));
 	memcpy(ent->d_name, ZSTR_VAL(basename), tmp_len);
-	ent->d_name[tmp_len - 1] = '\0';
+	ent->d_name[tmp_len] = '\0';
 	zend_string_release_ex(basename, 0);
 	ent->d_type = DT_UNKNOWN;
 

ext/standard/tests/filters/dechunk_size_overflow.phpt

@@ -0,0 +1,38 @@
+--TEST--
+dechunk filter must reject a chunk size that overflows size_t
+--SKIPIF--
+<?php
+$filters = stream_get_filters();
+if(! in_array( "dechunk", $filters )) die( "skip Chunked filter not available." );
+?>
+--INI--
+allow_url_fopen=1
+--FILE--
+<?php
+/* Both sizes exceed SIZE_MAX, so parsing stops and the rest is passed through
+   raw. The guard trips at SIZE_MAX/16, so how many digits are consumed first
+   follows the width of size_t: %s covers the leftover run. Unguarded, the
+   first size wraps to 0, which reads as the terminating chunk and drops the
+   body; the second wraps to SIZE_MAX and swallows the rest as one chunk. */
+$streams = [
+    "data://text/plain,10000000000000000\nBODYDATA\n0\n",
+    "data://text/plain,fffffffffffffffff\nBODYDATA\n0\n",
+    "data://text/plain,5\nhello\n0\n",
+];
+foreach ($streams as $name) {
+    $fp = fopen($name, "r");
+    stream_filter_append($fp, "dechunk", STREAM_FILTER_READ);
+    var_dump(stream_get_contents($fp));
+    fclose($fp);
+}
+?>
+--EXPECTF--
+string(%d) "%s
+BODYDATA
+0
+"
+string(%d) "%s
+BODYDATA
+0
+"
+string(5) "hello"

ext/standard/tests/streams/ftp_dirstream_oob.phpt

@@ -0,0 +1,33 @@
+--TEST--
+opendir() with 'ftp://' stream must not go out of bounds on an empty or slash-only listing line
+--SKIPIF--
+<?php
+if (array_search('ftp',stream_get_wrappers()) === FALSE) die("skip ftp wrapper not available.");
+if (!function_exists('pcntl_fork')) die("skip pcntl_fork() not available.");
+?>
+--FILE--
+<?php
+
+/* An empty line makes php_basename() return "\n" and a slash-only final line
+ * makes it return "", the two lengths the buffer math underflowed on. */
+$nlst_data = "file1\r\n\nb0rk\r\n/";
+
+require __DIR__ . "/../../../ftp/tests/server.inc";
+
+$path="ftp://localhost:" . $port."/";
+
+$ds=opendir($path);
+var_dump($ds);
+
+while (($fn=readdir($ds)) !== false) {
+      var_dump($fn);
+}
+
+closedir($ds);
+?>
+--EXPECTF--
+resource(%d) of type (stream)
+string(5) "file1"
+string(0) ""
+string(4) "b0rk"
+string(0) ""

ext/standard/tests/streams/opendir-002.phpt

@@ -25,5 +25,5 @@ closedir($ds);
 resource(%d) of type (stream)
 string(5) "file1"
 string(5) "file1"
-string(3) "fil"
+string(4) "file"
 string(4) "b0rk"

ext/standard/tests/streams/opendir-004.phpt

@@ -27,5 +27,5 @@ while ($fn=readdir($ds)) {
 resource(%d) of type (stream)
 string(5) "file1"
 string(5) "file1"
-string(3) "fil"
+string(4) "file"
 string(4) "b0rk"