Changeset 2186 for trunk/server

Timestamp:

May 5, 2012, 5:40:12 PM (13 years ago)

Author:

ezyang

Message:

Another mitigation to the PHP command line flags vulnerability.

File:

• trunk/server/common/patches/httpd-suexec-scripts.patch (modified) (2 diffs)

trunk/server/common/patches/httpd-suexec-scripts.patch

@@ -314 +314 @@
          exit(121);
      }
-@@ -614,6 +767,23 @@
+@@ -614,6 +767,30 @@
      /*
       * Execute the command, replacing our image with its own.
@@ -331 +331 @@
 +        argv[1] = PHP_PATH;
 +        argv[2] = "-f";
++        /*
++         * argv[3] is the command to run. argv[4] is either an argument or
++         * already null. We don't want to pass any arguments through from
++         * Apache (since they're untrusted), so we chop off the remainder
++         * of argv here.
++         */
++        argv[4] = 0;
 +        execv(PHP_PATH, &argv[1]);
 +        log_err("(%d)%s: php exec failed (%s)\n", errno, strerror(errno), argv[1]);