[php-maint] Bug#336645: php4: here is the patch

[Antoine Beaupre]

Package: php4
Version: 4:4.3.10-16
Followup-For: Bug #336645


here is a patch that applies cleanly on sarge:

http://cvs.php.net/diff.php/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.2&r2=1.543.2.51.2.3&ty=h

I append a modified patch that will apply cleanly on the sarge tree. I
hope this is going to help getting this fixed.

===================================================================
RCS file: /repository/php-src/ext/standard/basic_functions.c,v
retrieving revision 1.543.2.51.2.2
retrieving revision 1.543.2.51.2.3
diff -p --unified=3 -r1.543.2.51.2.2 -r1.543.2.51.2.3
--- basic_functions.c	2005/09/13 13:23:56	1.543.2.51.2.2
+++ basic_functions.c	2005/09/29 16:31:48	1.543.2.51.2.3
@@ -3027,11 +3027,25 @@
 	prefix = va_arg(args, char *);
 	prefix_len = va_arg(args, uint);

-	new_key_len = prefix_len + hash_key->nKeyLength;
-	new_key = (char *) emalloc(new_key_len);
+	if (!prefix_len) {
+		if (!hash_key->nKeyLength) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard.");
+			return 0;
+		} else if (!strcmp(hash_key->arKey, "GLOBALS")) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite.");
+			return 0;
+		}
+	}
+
+	if (hash_key->nKeyLength) {
+		new_key_len = prefix_len + hash_key->nKeyLength;
+		new_key = (char *) emalloc(new_key_len);

-	memcpy(new_key, prefix, prefix_len);
-	memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
+		memcpy(new_key, prefix, prefix_len);
+		memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
+	} else {
+		new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h);
+	}

 	zend_hash_del(&EG(symbol_table), new_key, new_key_len);
 	ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0);

-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.4.31
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages php4 depends on:
ii  libapache-mod-php4           4:4.3.10-16 server-side, HTML-embedded scripti
ii  php4-common                  4:4.3.10-16 Common files for packages built fr

-- debconf information excluded