Skip to content

Fix GH-24616: Socket transports accept ports above 65535 #24621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Marti2203 wants to merge 1 commit into
base: PHP-8.4
Choose a base branch
from
Open

Fix GH-24616: Socket transports accept ports above 65535 #24621

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions ext/standard/tests/network/gh24616.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
--TEST--
GH-24616 (fsockopen()/stream_socket_client() accept TCP ports above 65535)
--FILE--
<?php
$srv = stream_socket_server("tcp://127.0.0.1:0");
$name = stream_socket_get_name($srv, false);
$port = (int) substr($name, strrpos($name, ':') + 1);
$bad = $port + 65536;

var_dump(@stream_socket_client("tcp://127.0.0.1:$bad", $errno, $errstr));
var_dump($errstr === "Failed to parse port of address \"127.0.0.1:$bad\"");
var_dump(@fsockopen("127.0.0.1", $bad));
var_dump(@stream_socket_client("tcp://[::1]:$bad"));
var_dump(@stream_socket_client("tcp://127.0.0.1:-1"));
var_dump(@stream_socket_client("tcp://127.0.0.1:99999999999999999999"));
var_dump(@stream_socket_server("tcp://127.0.0.1:65536"));

$udp = stream_socket_server("udp://127.0.0.1:0", $errno, $errstr, STREAM_SERVER_BIND);
$name = stream_socket_get_name($udp, false);
$bad = (int) substr($name, strrpos($name, ':') + 1) + 65536;
$client = stream_socket_client("udp://127.0.0.1:1");
var_dump(@stream_socket_sendto($client, "x", 0, "127.0.0.1:$bad"));

/* Valid ports still work */
$c = stream_socket_client("tcp://127.0.0.1:$port");
var_dump(stream_socket_get_name($c, true) === "127.0.0.1:$port");
?>
--EXPECT--
bool(false)
bool(true)
bool(false)
bool(false)
bool(false)
bool(false)
bool(false)
bool(false)
bool(true)
4 changes: 2 additions & 2 deletions ext/standard/tests/streams/bug69521.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@
Bug #69521 Segfault in gc_collect_cycles()
--FILE--
<?php
$serverUri = "tcp://127.0.0.1:74321";
$sock = stream_socket_server($serverUri, $errno, $errstr, STREAM_SERVER_BIND | STREAM_SERVER_LISTEN);
$sock = stream_socket_server("tcp://127.0.0.1:0", $errno, $errstr, STREAM_SERVER_BIND | STREAM_SERVER_LISTEN);
$serverUri = "tcp://" . stream_socket_get_name($sock, false);

$fp = stream_socket_client($serverUri, $errNumber, $errString, 5, STREAM_CLIENT_CONNECT);

Expand Down
10 changes: 7 additions & 3 deletions main/network.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -556,7 +556,7 @@ PHPAPI zend_result php_network_parse_network_address_with_port(const char *addr,
const char *colon;
char *tmp;
zend_result ret = FAILURE;
short port;
zend_long port;
struct sockaddr_in *in4 = (struct sockaddr_in*)sa;
struct sockaddr **psal;
int n;
Expand All @@ -574,14 +574,18 @@ PHPAPI zend_result php_network_parse_network_address_with_port(const char *addr,
if (!colon || colon[1] != ':') {
return FAILURE;
}
port = atoi(colon + 2);
port = ZEND_STRTOL(colon + 2, NULL, 10);
addr++;
} else {
colon = memchr(addr, ':', addrlen);
if (!colon) {
return FAILURE;
}
port = atoi(colon + 1);
port = ZEND_STRTOL(colon + 1, NULL, 10);
}

if (port < 0 || port > 65535) {
return FAILURE;
}

tmp = estrndup(addr, colon - addr);
Expand Down
25 changes: 23 additions & 2 deletions main/streams/xp_socket.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -615,6 +615,17 @@ static inline int parse_unix_address(php_stream_xport_param *xparam, struct sock
}
#endif

static inline bool parse_port(const char *str, int *portno)
{
/* Like atoi(), but reject ports that do not fit in 16 bits */
zend_long port = ZEND_STRTOL(str, NULL, 10);
if (port < 0 || port > 65535) {
return false;
}
*portno = (int) port;
return true;
}

static inline char *parse_ip_address_ex(const char *str, size_t str_len, int *portno, int get_err, zend_string **err)
{
const char *colon;
Expand All @@ -635,7 +646,12 @@ static inline char *parse_ip_address_ex(const char *str, size_t str_len, int *po
}
return NULL;
}
*portno = atoi(p + 2);
if (!parse_port(p + 2, portno)) {
if (get_err) {
*err = strpprintf(0, "Failed to parse port of address \"%s\"", str);
}
return NULL;
}
return estrndup(str + 1, p - str - 1);
}
#endif
Expand All @@ -645,7 +661,12 @@ static inline char *parse_ip_address_ex(const char *str, size_t str_len, int *po
colon = NULL;
}
if (colon) {
*portno = atoi(colon + 1);
if (!parse_port(colon + 1, portno)) {
if (get_err) {
*err = strpprintf(0, "Failed to parse port of address \"%s\"", str);
}
return NULL;
}
host = estrndup(str, colon - str);
} else {
if (get_err) {
Expand Down
Loading