summaryrefslogtreecommitdiff
path: root/dev-lang/php/files/php-7.4.33-CVE-2023-0662.patch
diff options
context:
space:
mode:
Diffstat (limited to 'dev-lang/php/files/php-7.4.33-CVE-2023-0662.patch')
-rw-r--r--dev-lang/php/files/php-7.4.33-CVE-2023-0662.patch48
1 files changed, 0 insertions, 48 deletions
diff --git a/dev-lang/php/files/php-7.4.33-CVE-2023-0662.patch b/dev-lang/php/files/php-7.4.33-CVE-2023-0662.patch
deleted file mode 100644
index a6de37c27305..000000000000
--- a/dev-lang/php/files/php-7.4.33-CVE-2023-0662.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/main/main.c b/main/main.c
-index 40684f32dc14..c58ea58bf5ac 100644
---- a/main/main.c
-+++ b/main/main.c
-@@ -836,6 +836,7 @@ PHP_INI_BEGIN()
- PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, NULL)
- PHP_INI_ENTRY("disable_classes", "", PHP_INI_SYSTEM, NULL)
- PHP_INI_ENTRY("max_file_uploads", "20", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
-+ PHP_INI_ENTRY("max_multipart_body_parts", "-1", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
-
- STD_PHP_INI_BOOLEAN("allow_url_fopen", "1", PHP_INI_SYSTEM, OnUpdateBool, allow_url_fopen, php_core_globals, core_globals)
- STD_PHP_INI_BOOLEAN("allow_url_include", "0", PHP_INI_SYSTEM, OnUpdateBool, allow_url_include, php_core_globals, core_globals)
-diff --git a/main/rfc1867.c b/main/rfc1867.c
-index b43cfae5a1e2..3086e8da3dbe 100644
---- a/main/rfc1867.c
-+++ b/main/rfc1867.c
-@@ -694,6 +694,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
- void *event_extra_data = NULL;
- unsigned int llen = 0;
- int upload_cnt = INI_INT("max_file_uploads");
-+ int body_parts_cnt = INI_INT("max_multipart_body_parts");
- const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding();
- php_rfc1867_getword_t getword;
- php_rfc1867_getword_conf_t getword_conf;
-@@ -715,6 +716,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
- return;
- }
-
-+ if (body_parts_cnt < 0) {
-+ body_parts_cnt = PG(max_input_vars) + upload_cnt;
-+ }
-+ int body_parts_limit = body_parts_cnt;
-+
- /* Get the boundary */
- boundary = strstr(content_type_dup, "boundary");
- if (!boundary) {
-@@ -799,6 +805,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
- char *pair = NULL;
- int end = 0;
-
-+ if (--body_parts_cnt < 0) {
-+ php_error_docref(NULL, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
-+ goto fileupload_done;
-+ }
-+
- while (isspace(*cd)) {
- ++cd;
- }