fix(webserver/php): bound the IDENT strcpy into YYSTYPE.str_val (#887) - #890
Merged
mrjimenez merged 1 commit intoJun 6, 2026
Merged
Conversation
YYSTYPE.str_val is a fixed-size char[256] field in the semantic-value
union shared between the embedded PHP lexer and parser. The {IDENT}
action copies yytext into it with an unbounded strcpy, but the {IDENT}
regex itself is `[a-zA-Z_][a-zA-Z0-9_]*` -- flex grows yytext to hold
the entire matched lexeme, so any identifier of 256+ characters in any
.php template processed by amuleweb walks the strcpy off the end of the
str_val[256] field, corrupting whatever follows phplval in memory.
Input to the lexer is the .php files under the webserver document
root and any files they `include` (the include rule restricts the
path to a single-quoted [a-zA-Z_][a-zA-Z0-9_\\.\\-]* token, so no
remote URL pull or path traversal -- the trigger is local/file-
controlled, e.g. a malicious or merely careless skin template).
Defensive correctness fix regardless of the modest reachability: the
overflow is unconditional once such a token reaches the action, and
nothing upstream truncates.
Cap the copy at sizeof(str_val)-1 and NUL-terminate explicitly. The
fix is applied to both the .l source and the checked-in generated .c
because the build compiles the source-tree php_lexer.c directly when
FLEX isn't found at configure time (the macOS configure path on this
host); regenerating the .c via flex from the patched .l yields the
same bounded copy.
Fixes amule-project#887.
got3nks
added a commit
to got3nks/amule
that referenced
this pull request
Jun 7, 2026
…ule-project#912) Extends existing categories (preferring extensions over new lines): - Performance/Upload: amule-project#898 SlotAllocation default raised. - Networking & Discovery: wire-parser hardening list extended with amule-project#879/amule-project#882/amule-project#890/amule-project#886; new amuleweb security hardening bullet consolidating ngosang's amule-project#869-amule-project#874 triage (all landed in amule-project#875); amulegui list extended with amule-project#857; shared-folder watcher extended with amule-project#858. - Packaging: Windows installer i18n line extended with amule-project#899. - Internals & Refactoring: new docs-polish + code-quality bullets covering amule-project#851/amule-project#855/amule-project#862/amule-project#888/amule-project#900/amule-project#866/amule-project#867/amule-project#895 and amule-project#909/amule-project#910/amule-project#912. - Translations: new pre-release final-wave bullet covering amule-project#847/amule-project#856/ amule-project#891/amule-project#908/amule-project#860/amule-project#904/amule-project#859/amule-project#863/amule-project#861/amule-project#880/amule-project#911/amule-project#901/amule-project#902/amule-project#889/amule-project#868/amule-project#853. - Bug Fixes & Stability: amule-project#850/amule-project#854/amule-project#878/amule-project#906. - CI: ccache wiring (amule-project#892, amule-project#903) + CodeQL binutils-dev (amule-project#907). Contributors footer gains mifritscher and nguyenhoangminhhieu2004-gif (both first-time contributors). PR index extended through amule-project#912.
mrjimenez
pushed a commit
that referenced
this pull request
Jun 8, 2026
Extends existing categories (preferring extensions over new lines): - Performance/Upload: #898 SlotAllocation default raised. - Networking & Discovery: wire-parser hardening list extended with #879/#882/#890/#886; new amuleweb security hardening bullet consolidating ngosang's #869-#874 triage (all landed in #875); amulegui list extended with #857; shared-folder watcher extended with #858. - Packaging: Windows installer i18n line extended with #899. - Internals & Refactoring: new docs-polish + code-quality bullets covering #851/#855/#862/#888/#900/#866/#867/#895 and #909/#910/#912. - Translations: new pre-release final-wave bullet covering #847/#856/ #891/#908/#860/#904/#859/#863/#861/#880/#911/#901/#902/#889/#868/#853. - Bug Fixes & Stability: #850/#854/#878/#906. - CI: ccache wiring (#892, #903) + CodeQL binutils-dev (#907). Contributors footer gains mifritscher and nguyenhoangminhhieu2004-gif (both first-time contributors). PR index extended through #912.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #887.
YYSTYPE.str_valis a fixed-sizechar[256]field in the semantic-value union shared between the embedded PHP lexer and parser. The{IDENT}action copiesyytextinto it with an unboundedstrcpy, but the{IDENT}regex itself is[a-zA-Z_][a-zA-Z0-9_]*— flex growsyytextto hold the entire matched lexeme, so any identifier of 256+ characters in any.phptemplate processed byamulewebwalks thestrcpyoff the end of thestr_val[256]field, corrupting whatever followsphplvalin memory.Input to the lexer is the
.phpfiles under the webserver document root and any files theyinclude(the include rule restricts the path to a single-quoted[a-zA-Z_][a-zA-Z0-9_\.\-]*token, so no remote URL pull or path traversal — the trigger is local/file-controlled, e.g. a malicious or merely careless skin template). Defensive correctness fix regardless of the modest reachability: the overflow is unconditional once such a token reaches the action, and nothing upstream truncates.Cap the copy at
sizeof(str_val)-1and NUL-terminate explicitly. Applied to both the.lsource and the checked-in generated.cbecause the build compiles the source-treephp_lexer.cdirectly when FLEX isn't found at configure time (the macOS configure path on this host); regenerating the.cvia flex from the patched.lyields the same bounded copy.Tested: macOS local build (Apple Silicon, Homebrew) — clean.