--- embedaddon/php/main/php_variables.c 2012/02/21 23:48:05 1.1.1.1 +++ embedaddon/php/main/php_variables.c 2012/05/29 12:34:35 1.1.1.2 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: php_variables.c,v 1.1.1.1 2012/02/21 23:48:05 misho Exp $ */ +/* $Id: php_variables.c,v 1.1.1.2 2012/05/29 12:34:35 misho Exp $ */ #include #include "php.h" @@ -47,11 +47,7 @@ PHPAPI void php_register_variable_safe(char *var, char /* Prepare value */ Z_STRLEN(new_entry) = str_len; - if (PG(magic_quotes_gpc)) { - Z_STRVAL(new_entry) = php_addslashes(strval, Z_STRLEN(new_entry), &Z_STRLEN(new_entry), 0 TSRMLS_CC); - } else { - Z_STRVAL(new_entry) = estrndup(strval, Z_STRLEN(new_entry)); - } + Z_STRVAL(new_entry) = estrndup(strval, Z_STRLEN(new_entry)); Z_TYPE(new_entry) = IS_STRING; php_register_variable_ex(var, &new_entry, track_vars_array TSRMLS_CC); @@ -61,40 +57,39 @@ PHPAPI void php_register_variable_ex(char *var_name, z { char *p = NULL; char *ip; /* index pointer */ - char *index, *escaped_index = NULL; + char *index; char *var, *var_orig; int var_len, index_len; zval *gpc_element, **gpc_element_p; zend_bool is_array = 0; HashTable *symtable1 = NULL; + ALLOCA_FLAG(use_heap) assert(var_name != NULL); if (track_vars_array) { symtable1 = Z_ARRVAL_P(track_vars_array); - } else if (PG(register_globals)) { - if (!EG(active_symbol_table)) { - zend_rebuild_symbol_table(TSRMLS_C); - } - symtable1 = EG(active_symbol_table); } + if (!symtable1) { /* Nothing to do */ zval_dtor(val); return; } + + /* ignore leading spaces in the variable name */ + while (*var_name && *var_name==' ') { + var_name++; + } + /* * Prepare variable name */ + var_len = strlen(var_name); + var = var_orig = do_alloca(var_len + 1, use_heap); + memcpy(var_orig, var_name, var_len + 1); - var_orig = estrdup(var_name); - var = var_orig; - /* ignore leading spaces in the variable name */ - while (*var && *var==' ') { - var++; - } - /* ensure that we don't have spaces or dots in the variable name (not binary safe) */ for (p = var; *p; p++) { if (*p == ' ' || *p == '.') { @@ -110,7 +105,7 @@ PHPAPI void php_register_variable_ex(char *var_name, z if (var_len==0) { /* empty variable name, or variable name with a space in it */ zval_dtor(val); - efree(var_orig); + free_alloca(var_orig, use_heap); return; } @@ -119,7 +114,7 @@ PHPAPI void php_register_variable_ex(char *var_name, z var_len == sizeof("GLOBALS")-1 && !memcmp(var, "GLOBALS", sizeof("GLOBALS")-1)) { zval_dtor(val); - efree(var_orig); + free_alloca(var_orig, use_heap); return; } @@ -138,10 +133,7 @@ PHPAPI void php_register_variable_ex(char *var_name, z if (track_vars_array) { ht = Z_ARRVAL_P(track_vars_array); - zend_hash_del(ht, var, var_len + 1); - } else if (PG(register_globals)) { - ht = EG(active_symbol_table); - zend_hash_del(ht, var, var_len + 1); + zend_symtable_del(ht, var, var_len + 1); } zval_dtor(val); @@ -151,7 +143,7 @@ PHPAPI void php_register_variable_ex(char *var_name, z if (!PG(display_errors)) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variable nesting level exceeded %ld. To increase the limit change max_input_nesting_level in php.ini.", PG(max_input_nesting_level)); } - efree(var_orig); + free_alloca(var_orig, use_heap); return; } @@ -185,36 +177,16 @@ PHPAPI void php_register_variable_ex(char *var_name, z if (zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p) == FAILURE) { zval_ptr_dtor(&gpc_element); zval_dtor(val); - efree(var_orig); + free_alloca(var_orig, use_heap); return; } } else { - if (PG(magic_quotes_gpc)) { - escaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC); - } else { - escaped_index = index; - } - if (zend_symtable_find(symtable1, escaped_index, index_len + 1, (void **) &gpc_element_p) == FAILURE + if (zend_symtable_find(symtable1, index, index_len + 1, (void **) &gpc_element_p) == FAILURE || Z_TYPE_PP(gpc_element_p) != IS_ARRAY) { - if (zend_hash_num_elements(symtable1) <= PG(max_input_vars)) { - if (zend_hash_num_elements(symtable1) == PG(max_input_vars)) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars)); - } - MAKE_STD_ZVAL(gpc_element); - array_init(gpc_element); - zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p); - } else { - if (index != escaped_index) { - efree(escaped_index); - } - zval_dtor(val); - efree(var_orig); - return; - } + MAKE_STD_ZVAL(gpc_element); + array_init(gpc_element); + zend_symtable_update(symtable1, index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p); } - if (index != escaped_index) { - efree(escaped_index); - } } symtable1 = Z_ARRVAL_PP(gpc_element_p); /* ip pointed to the '[' character, now obtain the key */ @@ -239,11 +211,6 @@ plain_var: zval_ptr_dtor(&gpc_element); } } else { - if (PG(magic_quotes_gpc)) { - escaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC); - } else { - escaped_index = index; - } /* * According to rfc2965, more specific paths are listed above the less specific ones. * If we encounter a duplicate cookie name, we should skip it, since it is not possible @@ -252,30 +219,21 @@ plain_var: */ if (PG(http_globals)[TRACK_VARS_COOKIE] && symtable1 == Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]) && - zend_symtable_exists(symtable1, escaped_index, index_len + 1)) { + zend_symtable_exists(symtable1, index, index_len + 1)) { zval_ptr_dtor(&gpc_element); } else { - if (zend_hash_num_elements(symtable1) <= PG(max_input_vars)) { - if (zend_hash_num_elements(symtable1) == PG(max_input_vars)) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars)); - } - zend_symtable_update(symtable1, escaped_index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p); - } else { - zval_ptr_dtor(&gpc_element); - } + zend_symtable_update(symtable1, index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p); } - if (escaped_index != index) { - efree(escaped_index); - } } } - efree(var_orig); + free_alloca(var_orig, use_heap); } SAPI_API SAPI_POST_HANDLER_FUNC(php_std_post_handler) { char *var, *val, *e, *s, *p; zval *array_ptr = (zval *) arg; + long count = 0; if (SG(request_info).post_data == NULL) { return; @@ -289,6 +247,10 @@ last_value: if ((val = memchr(s, '=', (p - s)))) { /* have a value */ unsigned int val_len, new_val_len; + if (++count > PG(max_input_vars)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars)); + return; + } var = s; php_url_decode(var, (val - s)); @@ -322,6 +284,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data) zval *array_ptr; int free_buffer = 0; char *strtok_buf = NULL; + long count = 0; switch (arg) { case PARSE_POST: @@ -411,6 +374,11 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data) } } + if (++count > PG(max_input_vars)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars)); + break; + } + if (val) { /* have a value */ int val_len; unsigned int new_val_len; @@ -455,10 +423,6 @@ void _php_import_environment_variables(zval *array_ptr size_t alloc_size = sizeof(buf); unsigned long nlen; /* ptrdiff_t is not portable */ - /* turn off magic_quotes while importing environment variables */ - int magic_quotes_gpc = PG(magic_quotes_gpc); - PG(magic_quotes_gpc) = 0; - for (env = environ; env != NULL && *env != NULL; env++) { p = strchr(*env, '='); if (!p) { /* malformed entry? */ @@ -476,7 +440,6 @@ void _php_import_environment_variables(zval *array_ptr if (t != buf && t != NULL) { efree(t); } - PG(magic_quotes_gpc) = magic_quotes_gpc; } zend_bool php_std_auto_global_callback(char *name, uint name_len TSRMLS_DC) @@ -493,7 +456,7 @@ static void php_build_argv(char *s, zval *track_vars_a int count = 0; char *ss, *space; - if (!(PG(register_globals) || SG(request_info).argc || track_vars_array)) { + if (!(SG(request_info).argc || track_vars_array)) { return; } @@ -552,7 +515,7 @@ static void php_build_argv(char *s, zval *track_vars_a } Z_TYPE_P(argc) = IS_LONG; - if (PG(register_globals) || SG(request_info).argc) { + if (SG(request_info).argc) { Z_ADDREF_P(arr); Z_ADDREF_P(argc); zend_hash_update(&EG(symbol_table), "argv", sizeof("argv"), &arr, sizeof(zval *), NULL); @@ -590,8 +553,6 @@ PHPAPI int php_handle_special_queries(TSRMLS_D) static inline void php_register_server_variables(TSRMLS_D) { zval *array_ptr = NULL; - /* turn off magic_quotes while importing server variables */ - int magic_quotes_gpc = PG(magic_quotes_gpc); ALLOC_ZVAL(array_ptr); array_init(array_ptr); @@ -600,7 +561,6 @@ static inline void php_register_server_variables(TSRML zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_SERVER]); } PG(http_globals)[TRACK_VARS_SERVER] = array_ptr; - PG(magic_quotes_gpc) = 0; /* Server variables */ if (sapi_module.register_server_variables) { @@ -619,13 +579,15 @@ static inline void php_register_server_variables(TSRML } /* store request init time */ { - zval new_entry; - Z_TYPE(new_entry) = IS_LONG; - Z_LVAL(new_entry) = sapi_get_request_time(TSRMLS_C); - php_register_variable_ex("REQUEST_TIME", &new_entry, array_ptr TSRMLS_CC); + zval request_time_float, request_time_long; + Z_TYPE(request_time_float) = IS_DOUBLE; + Z_DVAL(request_time_float) = sapi_get_request_time(TSRMLS_C); + php_register_variable_ex("REQUEST_TIME_FLOAT", &request_time_float, array_ptr TSRMLS_CC); + Z_TYPE(request_time_long) = IS_LONG; + Z_LVAL(request_time_long) = zend_dval_to_lval(Z_DVAL(request_time_float)); + php_register_variable_ex("REQUEST_TIME", &request_time_long, array_ptr TSRMLS_CC); } - PG(magic_quotes_gpc) = magic_quotes_gpc; } /* }}} */ @@ -639,7 +601,7 @@ static void php_autoglobal_merge(HashTable *dest, Hash ulong num_key; HashPosition pos; int key_type; - int globals_check = (PG(register_globals) && (dest == (&EG(symbol_table)))); + int globals_check = (dest == (&EG(symbol_table))); zend_hash_internal_pointer_reset_ex(src, &pos); while (zend_hash_get_current_data_ex(src, (void **)&src_entry, &pos) == SUCCESS) { @@ -648,10 +610,9 @@ static void php_autoglobal_merge(HashTable *dest, Hash || (key_type == HASH_KEY_IS_STRING && zend_hash_find(dest, string_key, string_key_len, (void **) &dest_entry) != SUCCESS) || (key_type == HASH_KEY_IS_LONG && zend_hash_index_find(dest, num_key, (void **)&dest_entry) != SUCCESS) || Z_TYPE_PP(dest_entry) != IS_ARRAY - ) { + ) { Z_ADDREF_PP(src_entry); if (key_type == HASH_KEY_IS_STRING) { - /* if register_globals is on and working with main symbol table, prevent overwriting of GLOBALS */ if (!globals_check || string_key_len != sizeof("GLOBALS") || memcmp(string_key, "GLOBALS", sizeof("GLOBALS") - 1)) { zend_hash_update(dest, string_key, string_key_len, src_entry, sizeof(zval *), NULL); } else { @@ -669,130 +630,116 @@ static void php_autoglobal_merge(HashTable *dest, Hash } /* }}} */ -static zend_bool php_auto_globals_create_server(char *name, uint name_len TSRMLS_DC); -static zend_bool php_auto_globals_create_env(char *name, uint name_len TSRMLS_DC); -static zend_bool php_auto_globals_create_request(char *name, uint name_len TSRMLS_DC); +static zend_bool php_auto_globals_create_server(const char *name, uint name_len TSRMLS_DC); +static zend_bool php_auto_globals_create_env(const char *name, uint name_len TSRMLS_DC); +static zend_bool php_auto_globals_create_request(const char *name, uint name_len TSRMLS_DC); /* {{{ php_hash_environment */ int php_hash_environment(TSRMLS_D) { - char *p; - unsigned char _gpc_flags[5] = {0, 0, 0, 0, 0}; - zend_bool jit_initialization = (PG(auto_globals_jit) && !PG(register_globals) && !PG(register_long_arrays)); - struct auto_global_record { - char *name; - uint name_len; - char *long_name; - uint long_name_len; - zend_bool jit_initialization; - } auto_global_records[] = { - { "_POST", sizeof("_POST"), "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"), 0 }, - { "_GET", sizeof("_GET"), "HTTP_GET_VARS", sizeof("HTTP_GET_VARS"), 0 }, - { "_COOKIE", sizeof("_COOKIE"), "HTTP_COOKIE_VARS", sizeof("HTTP_COOKIE_VARS"), 0 }, - { "_SERVER", sizeof("_SERVER"), "HTTP_SERVER_VARS", sizeof("HTTP_SERVER_VARS"), 1 }, - { "_ENV", sizeof("_ENV"), "HTTP_ENV_VARS", sizeof("HTTP_ENV_VARS"), 1 }, - { "_FILES", sizeof("_FILES"), "HTTP_POST_FILES", sizeof("HTTP_POST_FILES"), 0 }, - }; - size_t num_track_vars = sizeof(auto_global_records)/sizeof(struct auto_global_record); - size_t i; - - /* jit_initialization = 0; */ - for (i=0; i