Refactor password_hash to use random_bytes internally to generate salts

NEWS

@@ -1,8 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2015, PHP 7.0.1
+17 Dec 2015, PHP 7.0.1
 
 - Core:
+  . Fixed bug #71105 (Format String Vulnerability in Class Name Error Message).
+    (andrew at jmpesp dot org)
   . Fixed bug #70831 (Compile fails on system with 160 CPUs).
     (Daniel Axtens)
   . Fixed bug #71006 (symbol referencing errors on Sparc/Solaris). (Dmitry)

Zend/zend_execute_API.c

@@ -218,7 +218,7 @@ static void zend_throw_or_error(int fetch_type, zend_class_entry *exception_ce,
 	zend_vspprintf(&message, 0, format, va);
 
 	if (fetch_type & ZEND_FETCH_CLASS_EXCEPTION) {
-		zend_throw_error(exception_ce, message);
+		zend_throw_error(exception_ce, "%s", message);
 	} else {
 		zend_error(E_ERROR, "%s", message);
 	}

configure.in

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
 PHP_RELEASE_VERSION=1
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/opcache/ZendAccelerator.c

@@ -40,10 +40,10 @@
 #include "zend_accelerator_util_funcs.h"
 #include "zend_accelerator_hash.h"
 #include "ext/pcre/php_pcre.h"
+#include "ext/standard/md5.h"
 
 #ifdef HAVE_OPCACHE_FILE_CACHE
 # include "zend_file_cache.h"
-# include "ext/standard/md5.h"
 #endif
 
 #ifndef ZEND_WIN32

ext/standard/password.c

@@ -30,6 +30,7 @@
 #include "base64.h"
 #include "zend_interfaces.h"
 #include "info.h"
+#include "php_random.h"
 
 #if PHP_WIN32
 #include "win32/winutil.h"
@@ -123,37 +124,10 @@ static int php_password_make_salt(size_t length, char *ret) /* {{{ */
 
 	buffer = (char *) safe_emalloc(raw_length, 1, 1);
 
-#if PHP_WIN32
-	{
-		BYTE *iv_b = (BYTE *) buffer;
-		if (php_win32_get_random_bytes(iv_b, raw_length) == SUCCESS) {
-			buffer_valid = 1;
-		}
-	}
-#else
-	{
-		int fd, n;
-		size_t read_bytes = 0;
-		fd = open("/dev/urandom", O_RDONLY);
-		if (fd >= 0) {
-			while (read_bytes < raw_length) {
-				n = read(fd, buffer + read_bytes, raw_length - read_bytes);
-				if (n < 0) {
-					break;
-				}
-				read_bytes += (size_t) n;
-			}
-			close(fd);
-		}
-		if (read_bytes >= raw_length) {
-			buffer_valid = 1;
-		}
-	}
-#endif
-	if (!buffer_valid) {
-		for (i = 0; i < raw_length; i++) {
-			buffer[i] ^= (char) (255.0 * php_rand() / RAND_MAX);
-		}
+	if (FAILURE == php_random_bytes_silent(buffer, raw_length)) {
+		php_error_docref(NULL, E_WARNING, "Unable to generate salt");
+		efree(buffer);
+		return FAILURE;
 	}
 
 	result = safe_emalloc(length, 1, 1);

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 0
 #define PHP_RELEASE_VERSION 1
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.0.1-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.0.1"
 #define PHP_VERSION_ID 70001

sapi/litespeed/lsapilib.c

@@ -128,7 +128,7 @@ static int s_pid_dump_debug_info = 0;
 
 LSAPI_Request g_req = { -1, -1 };
 
-static char         s_pSecret[24];
+static char         s_secret[24];
 
 
 void Flush_RespBuf_r( LSAPI_Request * pReq );
@@ -437,7 +437,7 @@ static int allocateEnvList( struct LSAPI_key_value_pair ** pEnvList,
                         int *curSize, int newSize )
 {
     struct LSAPI_key_value_pair * pBuf;
-        if ( *curSize >= newSize )
+    if ( *curSize >= newSize )
         return 0;
     if ( newSize > 8192 )
         return -1;
@@ -559,6 +559,40 @@ static void fixHeaderIndexEndian( LSAPI_Request * pReq )
     }
 }
 
+
+static int validateHeaders( LSAPI_Request * pReq )
+{
+    int totalLen = pReq->m_pHeader->m_httpHeaderLen;
+    int i;
+    for(i = 0; i < H_TRANSFER_ENCODING; ++i)
+    {
+        if ( pReq->m_pHeaderIndex->m_headerOff[i] )
+        {
+            if (pReq->m_pHeaderIndex->m_headerOff[i] > totalLen 
+                || pReq->m_pHeaderIndex->m_headerLen[i] 
+                    + pReq->m_pHeaderIndex->m_headerOff[i] > totalLen)
+                return -1;
+        }
+    }
+    if (pReq->m_pHeader->m_cntUnknownHeaders > 0)
+    {
+        struct lsapi_header_offset * pCur, *pEnd;
+        pCur = pReq->m_pUnknownHeader;
+        pEnd = pCur + pReq->m_pHeader->m_cntUnknownHeaders;
+        while( pCur < pEnd )
+        {
+            if (pCur->nameOff > totalLen 
+                || pCur->nameOff + pCur->nameLen > totalLen 
+                || pCur->valueOff > totalLen
+                || pCur->valueOff + pCur->valueLen > totalLen)
+                return -1;
+            ++pCur;
+        }
+    }
+    return 0;
+}
+
+
 static uid_t s_uid = 0;
 static uid_t s_defaultUid;  //web server need set this
 static gid_t s_defaultGid;
@@ -670,7 +704,7 @@ static int readSecret( const char * pSecretFile )
         close( fd );
         return -1;
     }
-    if ( read( fd, s_pSecret, 16 ) < 16 )
+    if ( read( fd, s_secret, 16 ) < 16 )
     {
         fprintf( stderr, "LSAPI: failed to read secret from secret file: %s\n", pSecretFile );
         close( fd );
@@ -682,7 +716,7 @@ static int readSecret( const char * pSecretFile )
 
 int LSAPI_is_suEXEC_Daemon()
 {
-    if (( !s_uid )&&( s_pSecret[0] ))
+    if (( !s_uid )&&( s_secret[0] ))
         return 1;
     else
         return 0;
@@ -877,7 +911,7 @@ static int lsapi_suexec_auth( LSAPI_Request *pReq,
     if ( len < 32 )
         return -1;
     memmove( achMD5, pAuth + 16, 16 );
-    memmove( pAuth + 16, s_pSecret, 16 );
+    memmove( pAuth + 16, s_secret, 16 );
     lsapi_MD5Init( &md5ctx );
     lsapi_MD5Update( &md5ctx, (unsigned char *)pAuth, 32 );
     lsapi_MD5Update( &md5ctx, (unsigned char *)pUgid, 8 );
@@ -999,7 +1033,18 @@ static int parseRequest( LSAPI_Request * pReq, int totalLen )
     if ( parseEnv( pReq->m_pEnvList, pReq->m_pHeader->m_cntEnv,
                 &pBegin, pEnd ) == -1 )
         return -1;
-
+    if (pReq->m_pHeader->m_scriptFileOff < 0 
+        || pReq->m_pHeader->m_scriptFileOff >= totalLen 
+        || pReq->m_pHeader->m_scriptNameOff < 0
+        || pReq->m_pHeader->m_scriptNameOff >= totalLen
+        || pReq->m_pHeader->m_queryStringOff < 0
+        || pReq->m_pHeader->m_queryStringOff >= totalLen
+        || pReq->m_pHeader->m_requestMethodOff < 0 
+        || pReq->m_pHeader->m_requestMethodOff >= totalLen)
+    {
+        fprintf(stderr, "%d: bad request header - ERROR#1\n", getpid());
+        return -1;
+    }
     pReq->m_pScriptFile     = pReq->m_pReqBuf + pReq->m_pHeader->m_scriptFileOff;
     pReq->m_pScriptName     = pReq->m_pReqBuf + pReq->m_pHeader->m_scriptNameOff;
     pReq->m_pQueryString    = pReq->m_pReqBuf + pReq->m_pHeader->m_queryStringOff;
@@ -1025,6 +1070,13 @@ static int parseRequest( LSAPI_Request * pReq, int totalLen )
     {
         fixHeaderIndexEndian( pReq );
     }
+    
+    if (validateHeaders(pReq) == -1)
+    {
+        fprintf(stderr, "%d: bad request header - ERROR#2\n", getpid());
+        return -1;
+    }
+    
     pReq->m_reqBodyLen = pReq->m_pHeader->m_reqBodyLen;
     if ( pReq->m_reqBodyLen == -2 )
     {
@@ -1170,8 +1222,11 @@ static int readReq( LSAPI_Request * pReq )
     pReq->m_reqState = LSAPI_ST_REQ_BODY | LSAPI_ST_RESP_HEADER;
 
     if ( !s_uid )
+    {
         if ( lsapi_changeUGid( pReq ) )
             return -1;
+        memset(s_secret, 0, sizeof(s_secret));
+    }
     pReq->m_bufProcessed = packetLen;
 
     //OPTIMIZATION
@@ -1191,7 +1246,7 @@ int LSAPI_Init(void)
     if ( !g_inited )
     {
         s_uid = geteuid();
-        s_pSecret[0] = 0;
+        s_secret[0] = 0;
         lsapi_signal(SIGPIPE, lsapi_sigpipe);
         lsapi_signal(SIGUSR1, lsapi_siguser1);