oss-security - Re: Re: CVE Request: PHP

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <54C40A9B.6090809@internot.info>
Date: Sun, 25 Jan 2015 08:11:55 +1100
From: Joshua Rogers <oss@...ernot.info>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE Request: PHP

On 25/01/15 07:43, Joshua Rogers wrote:
> "REG_EXTENDED", according to the regex(3) manual, is for "POSIX Extended
> Regular Expression syntax"
>
> which probably isn't that common.
Actually, I worked it out:

if you edit the isinsets function,

with this:

        register unsigned uc = (unsigned char)c;
        printf("ncols: %d\n", ncols);

        for (i = 0, col = g->setbits; i < ncols; i++, col += g->csetsize) {
        printf("inside isinsets2: %d\n", col[uc]); 
                if (col[uc] != 0)
                        return(1);
        }

you'll see  that 'isinsets' is false on a normal run of ereg(which is
extended POSIX regex by default)
and when running ereg, it'll printf 'ncols: 0' constantly.

I don't know how 'sets' are done in PHP ereg, however.


Thanks,
-- 
-- Joshua Rogers <https://internot.info/>


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.