Possible security issue with enchant on Windows.
[email protected] (Richard Quadling)
| Newsgroups | php.internals.win |
|---|---|
| Message-ID | <[email protected]> |
Hi.
I'm getting a crash, which I believe is due to enchant.
The issue is (as I am seeing it), is that enchant scans and loads DLLs
from the C:\PHP5 directory which have nothing to do with enchant.
Specifically, I created a dummy vm to test some IIS7+PHP Fast/CGI
settings with PHP.
I wanted to use Jason Hood's ANSICon to allow me to see ANSI encoded
output on the console.
Being ultra lazy, I dropped ANSICon.exe and ANSI.dll into C:\PHP5,
which is in the path, ran ANSICON -i, and then I'm done.
When running <?php phpinfo(); ?> IIS crashes, tracking back to
ANSI.dll_unloaded.
No other script was failing - I don't use enchant yet, but was doing
some documentation tests so have it enabled.
I tried running php-cgi -i from the command line. Got a crash.
I tried running php -i from the command line. Got a crash.
In both instances, the output stops at enchant.
Removing enchant from the list of loadable extensions and the problem goes away.
Ok, putting any old DLL into C:\PHP5 isn't a good idea, but neither is
having a PHP extension automatically load everything it can get its
hands on.
ANSI.dll does not import any function but exports a single function ...
Import Ordinal Hint Function Entry Point
------ ---------- ---------- ---------- -----------
Export Ordinal Hint Function Entry Point
------ ---------- ---------- ---------- -----------
[C ] 1 (0x0001) 0 (0x0000) DllMain@12 0x00002920
Whilst I'm only experiencing a crash, other users, maybe those using
enchant, could end up with something a lot more of an issue.
The example code from
http://docs.php.net/manual/en/enchant.examples.php will also generate
the crash with the ansi.dll present in the C:\PHP5 directory.
--
-----
Richard Quadling
"Standing on the shoulders of some very clever giants!"
EE : http://www.experts-exchange.com/M_248814.html
Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731
ZOPA : http://uk.zopa.com/member/RQuadling