Fixed bug #32936 (http redirects URLs are not checked for control chars).

1 files changed, 28 insertions, 0 deletions

diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
index db7e5ee54c..066af3cb24 100644
--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@ -551,6 +551,34 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
 			} else {
 				strlcpy(new_path, location, sizeof(new_path));
 			}
+
+			php_url_free(resource);
+			/* check for invalid redirection URLs */
+			if ((resource = php_url_parse(new_path)) == NULL) {
+				php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Invalid redirect url! %s", new_path);
+				goto out;
+			}
+
+#define CHECK_FOR_CNTRL_CHARS(val) {	\
+	if (val) {	\
+		unsigned char *s, *e;	\
+		int l;	\
+		l = php_url_decode(val, strlen(val));	\
+		s = val; e = s + l;	\
+		while (s < e) {	\
+			if (iscntrl(*s)) {	\
+				php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Invalid redirect url! %s", new_path);	\
+				goto out;	\
+			}	\
+			s++;	\
+		}	\
+	}	\
+}	\
+			/* check for control characters in login, password & path */
+			CHECK_FOR_CNTRL_CHARS(resource->user)
+			CHECK_FOR_CNTRL_CHARS(resource->pass)
+			CHECK_FOR_CNTRL_CHARS(resource->path)
+
 			stream = php_stream_url_wrap_http_ex(wrapper, new_path, mode, options, opened_path, context, --redirect_max, 0 STREAMS_CC TSRMLS_CC);
 			if (stream && stream->wrapperdata)	{
 				entryp = &entry;