Skip to content

Fix object key validation #254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 13, 2016
Merged

Fix object key validation #254

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7266824
Fix object key validation
pmmaga Jun 9, 2016
382a786
Added tests for the extended key validation
pmmaga Jun 9, 2016
5bd1a1f
fix added tests
pmmaga Jun 9, 2016
6e32d40
Use a constant for object key max length
pmmaga Jun 10, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions php_memcached.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,11 @@
#define JSON_PARSER_DEFAULT_DEPTH 512
#endif

/****************************************
Protocol parameters
****************************************/
#define MEMC_OBJECT_KEY_MAX_LENGTH 250

/****************************************
Custom options
****************************************/
Expand Down Expand Up @@ -576,7 +581,7 @@ static void php_memc_get_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool by_key)
MEMC_METHOD_FETCH_OBJECT;
i_obj->rescode = MEMCACHED_SUCCESS;

if (key_len == 0 || strchr(key, ' ')) {
if (key_len == 0 || key_len > MEMC_OBJECT_KEY_MAX_LENGTH || strchr(key, ' ') || strchr(key, '\n')) {
i_obj->rescode = MEMCACHED_BAD_KEY_PROVIDED;
RETURN_FROM_GET;
}
Expand Down Expand Up @@ -1448,7 +1453,7 @@ static void php_memc_store_impl(INTERNAL_FUNCTION_PARAMETERS, int op, zend_bool
MEMC_METHOD_FETCH_OBJECT;
i_obj->rescode = MEMCACHED_SUCCESS;

if (key_len == 0 || strchr(key, ' ')) {
if (key_len == 0 || key_len > MEMC_OBJECT_KEY_MAX_LENGTH || strchr(key, ' ') || strchr(key, '\n')) {
i_obj->rescode = MEMCACHED_BAD_KEY_PROVIDED;
RETURN_FALSE;
}
Expand Down Expand Up @@ -1599,7 +1604,7 @@ static void php_memc_cas_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool by_key)
MEMC_METHOD_FETCH_OBJECT;
i_obj->rescode = MEMCACHED_SUCCESS;

if (key_len == 0 || strchr(key, ' ')) {
if (key_len == 0 || key_len > MEMC_OBJECT_KEY_MAX_LENGTH || strchr(key, ' ') || strchr(key, '\n')) {
i_obj->rescode = MEMCACHED_BAD_KEY_PROVIDED;
RETURN_FALSE;
}
Expand Down Expand Up @@ -1717,7 +1722,7 @@ static void php_memc_delete_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool by_key)
MEMC_METHOD_FETCH_OBJECT;
i_obj->rescode = MEMCACHED_SUCCESS;

if (key_len == 0 || strchr(key, ' ')) {
if (key_len == 0 || key_len > MEMC_OBJECT_KEY_MAX_LENGTH || strchr(key, ' ') || strchr(key, '\n')) {
i_obj->rescode = MEMCACHED_BAD_KEY_PROVIDED;
RETURN_FALSE;
}
Expand Down Expand Up @@ -1817,7 +1822,7 @@ static void php_memc_incdec_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool by_key,
MEMC_METHOD_FETCH_OBJECT;
i_obj->rescode = MEMCACHED_SUCCESS;

if (key_len == 0 || strchr(key, ' ')) {
if (key_len == 0 || key_len > MEMC_OBJECT_KEY_MAX_LENGTH || strchr(key, ' ') || strchr(key, '\n')) {
i_obj->rescode = MEMCACHED_BAD_KEY_PROVIDED;
RETURN_FALSE;
}
Expand Down
15 changes: 15 additions & 0 deletions tests/keys.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,18 @@ $ascii = memc_get_instance ();
var_dump ($binary->set ('binary key with spaces', 'this is a test'));
var_dump ($binary->getResultCode () == Memcached::RES_BAD_KEY_PROVIDED);

var_dump ($binary->set ('binarykeywithnewline' . PHP_EOL, 'this is a test'));
var_dump ($binary->getResultCode () == Memcached::RES_BAD_KEY_PROVIDED);

var_dump ($ascii->set ('ascii key with spaces', 'this is a test'));
var_dump ($ascii->getResultCode () == Memcached::RES_BAD_KEY_PROVIDED);

var_dump ($binary->set ('asciikeywithnewline' . PHP_EOL, 'this is a test'));
var_dump ($binary->getResultCode () == Memcached::RES_BAD_KEY_PROVIDED);

var_dump ($ascii->set (''/*empty key*/, 'this is a test'));
var_dump ($ascii->getResultCode () == Memcached::RES_BAD_KEY_PROVIDED);

var_dump ($ascii->set (str_repeat ('1234567890', 512), 'this is a test'));
var_dump ($ascii->getResultCode () == Memcached::RES_BAD_KEY_PROVIDED);

Expand All @@ -30,4 +39,10 @@ bool(false)
bool(true)
bool(false)
bool(true)
bool(false)
bool(true)
bool(false)
bool(true)
bool(false)
bool(true)
OK