Repository navigation
Sqlite ATTACH is crashing php when the filename is bind /w open_basedir set #9032
Description
Description
The following code:
<?php
$db = new \PDO("sqlite::memory:");
$db->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION);
$db->exec('attach database \':memory:\' AS "db1"');
var_dump($db->exec('create table db1.r (id int)'));
$st = $db->prepare('attach database :a AS "db2"');
$st->execute([':a' => ':memory:']);
var_dump($db->exec('create table db2.r (id int)'));demo: https://3v4l.org/Su8lK
Resulted in this output:
int(0)
Process exited with code 139.
But I expected this output instead:
int(0)
int(0)
PHP Version
any
Operating System
any
Activity
devnexen commentedon Jul 17, 2022
Can you reproduce the issue outside of docker ? Tested with proper releases and manually master build and having expected outputs.
mvorisek commentedon Jul 17, 2022
PHP crashed also when reproduced in GH Actions CI.
I tested now also on my local/not virtualized Windows machine - PHP crashed too, only the first
int(0)was displayed.cmb69 commentedon Jul 17, 2022
That might be an issue with SQLite3 itself. Which version do you use, see https://3v4l.org/PrC72.
mvorisek commentedon Jul 17, 2022
On my Windows machine I use
3.31.1. @devnexen when you tested it, did you see 1 or 2int(0)?devnexen commentedon Jul 17, 2022
2 always, tried with baremetal Linux machines; old CentOs 7 and Alpine virtualized. Also tried at last a manually build with sanitizers in case.
mvorisek commentedon Jul 17, 2022
@devnexen with what Sqlite versions?
https://3v4l.org/NZnPl /w EOL PHP versions shows it is broken since PHP 5.5
interestingly, Sqlite v3.7.7.1 /w PHP 5.5.x is broken, but Sqlite v3.8.10.2 /w PHP 5.4.x is fine. It seems at least something in php-src has impact on this issue.
I also tested
PDOStatement::bindParam. Same issue as withPDOStatement::bindValue.mvorisek commentedon Jul 17, 2022
I looked into the php-src code - https://github.com/search?q=SQLITE_ATTACHrepo%3Aphp%2Fphp-src&type=Code&ref=advsearch
for
SQLITE_ATTACHthe code does some security checks. And I think that is the issue. I haveopen_basedirconfigured for all the tested platforms. Can it be related?https://3v4l.org/TLlCo - the answer seems yes!
[-]`ATTACH :a AS xx` is crashing php (Sqlite/PDOStatement::bindValue)[/-][+]Sqlite `ATTACH` is crashing php when the filename is bind /w `open_basedir` set[/+]devnexen commentedon Jul 17, 2022
Ah was going to ask if you had any particular context, I even ventured into docker official images and still did not get any issue, and locally my sqlite versions ran from 3.7.17 to 3.38.5.
cmb69 commentedon Jul 17, 2022
Yeah, the problem is that
NULLis passed tomake_filename_safe()for which it is not prepared. Quick-fix:This needs more careful investigation, though. It might be possible to not necessarily deny authorization, and the
SQLITE_COPYcase should be investigated as well.devnexen commentedon Jul 17, 2022
If we want to deny in copy too might be simpler to return NULL in this make_filename_safe helper then ? But indeed might need further look.
Fix phpGH-9032: SQLite3 authorizer crashes on NULL values
Fix GH-9032: SQLite3 authorizer crashes on NULL values
Merge branch 'PHP-8.0' into PHP-8.1
Merge branch 'PHP-8.1'