xref: /PHP-5.6/ext/standard/exec.c (revision 1fd18821)
1 /*
2    +----------------------------------------------------------------------+
3    | PHP Version 5                                                        |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1997-2016 The PHP Group                                |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.php.net/license/3_01.txt                                  |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Author: Rasmus Lerdorf <rasmus@php.net>                              |
16    |         Ilia Alshanetsky <iliaa@php.net>                             |
17    +----------------------------------------------------------------------+
18  */
19 /* $Id$ */
20 
21 #include <stdio.h>
22 #include "php.h"
23 #include <ctype.h>
24 #include "php_string.h"
25 #include "ext/standard/head.h"
26 #include "ext/standard/file.h"
27 #include "basic_functions.h"
28 #include "exec.h"
29 #include "php_globals.h"
30 #include "SAPI.h"
31 
32 #if HAVE_SYS_WAIT_H
33 #include <sys/wait.h>
34 #endif
35 #if HAVE_SIGNAL_H
36 #include <signal.h>
37 #endif
38 
39 #if HAVE_SYS_TYPES_H
40 #include <sys/types.h>
41 #endif
42 #if HAVE_SYS_STAT_H
43 #include <sys/stat.h>
44 #endif
45 #if HAVE_FCNTL_H
46 #include <fcntl.h>
47 #endif
48 
49 #if HAVE_UNISTD_H
50 #include <unistd.h>
51 #endif
52 
53 #if HAVE_LIMITS_H
54 #include <limits.h>
55 #endif
56 
57 #ifdef PHP_WIN32
58 # include "win32/php_stdint.h"
59 #else
60 # if HAVE_INTTYPES_H
61 #  include <inttypes.h>
62 # elif HAVE_STDINT_H
63 #  include <stdint.h>
64 # endif
65 #endif
66 
67 static int cmd_max_len;
68 
69 /* {{{ PHP_MINIT_FUNCTION(exec) */
PHP_MINIT_FUNCTION(exec)70 PHP_MINIT_FUNCTION(exec)
71 {
72 #ifdef _SC_ARG_MAX
73 	cmd_max_len = sysconf(_SC_ARG_MAX);
74 	if (-1 == cmd_max_len) {
75 #ifdef _POSIX_ARG_MAX
76                cmd_max_len = _POSIX_ARG_MAX;
77 #else
78                cmd_max_len = 4096;
79 #endif
80        }
81 #elif defined(ARG_MAX)
82 	cmd_max_len = ARG_MAX;
83 #elif defined(PHP_WIN32)
84 	/* Executed commands will run through cmd.exe. As long as it's the case,
85 		it's just the constant limit.*/
86 	cmd_max_len = 8192;
87 #else
88 	/* This is just an arbitrary value for the fallback case. */
89 	cmd_max_len = 4096;
90 #endif
91 
92 	return SUCCESS;
93 }
94 /* }}} */
95 
96 /* {{{ php_exec
97  * If type==0, only last line of output is returned (exec)
98  * If type==1, all lines will be printed and last lined returned (system)
99  * If type==2, all lines will be saved to given array (exec with &$array)
100  * If type==3, output will be printed binary, no lines will be saved or returned (passthru)
101  *
102  */
php_exec(int type,char * cmd,zval * array,zval * return_value TSRMLS_DC)103 PHPAPI int php_exec(int type, char *cmd, zval *array, zval *return_value TSRMLS_DC)
104 {
105 	FILE *fp;
106 	char *buf;
107 	int l = 0, pclose_return;
108 	char *b, *d=NULL;
109 	php_stream *stream;
110 	size_t buflen, bufl = 0;
111 #if PHP_SIGCHILD
112 	void (*sig_handler)() = NULL;
113 #endif
114 
115 #if PHP_SIGCHILD
116 	sig_handler = signal (SIGCHLD, SIG_DFL);
117 #endif
118 
119 #ifdef PHP_WIN32
120 	fp = VCWD_POPEN(cmd, "rb");
121 #else
122 	fp = VCWD_POPEN(cmd, "r");
123 #endif
124 	if (!fp) {
125 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to fork [%s]", cmd);
126 		goto err;
127 	}
128 
129 	stream = php_stream_fopen_from_pipe(fp, "rb");
130 
131 	buf = (char *) emalloc(EXEC_INPUT_BUF);
132 	buflen = EXEC_INPUT_BUF;
133 
134 	if (type != 3) {
135 		b = buf;
136 
137 		while (php_stream_get_line(stream, b, EXEC_INPUT_BUF, &bufl)) {
138 			/* no new line found, let's read some more */
139 			if (b[bufl - 1] != '\n' && !php_stream_eof(stream)) {
140 				if (buflen < (bufl + (b - buf) + EXEC_INPUT_BUF)) {
141 					bufl += b - buf;
142 					buflen = bufl + EXEC_INPUT_BUF;
143 					buf = erealloc(buf, buflen);
144 					b = buf + bufl;
145 				} else {
146 					b += bufl;
147 				}
148 				continue;
149 			} else if (b != buf) {
150 				bufl += b - buf;
151 			}
152 
153 			if (type == 1) {
154 				PHPWRITE(buf, bufl);
155 				if (php_output_get_level(TSRMLS_C) < 1) {
156 					sapi_flush(TSRMLS_C);
157 				}
158 			} else if (type == 2) {
159 				/* strip trailing whitespaces */
160 				l = bufl;
161 				while (l-- && isspace(((unsigned char *)buf)[l]));
162 				if (l != (int)(bufl - 1)) {
163 					bufl = l + 1;
164 					buf[bufl] = '\0';
165 				}
166 				add_next_index_stringl(array, buf, bufl, 1);
167 			}
168 			b = buf;
169 		}
170 		if (bufl) {
171 			/* strip trailing whitespaces if we have not done so already */
172 			if ((type == 2 && buf != b) || type != 2) {
173 				l = bufl;
174 				while (l-- && isspace(((unsigned char *)buf)[l]));
175 				if (l != (int)(bufl - 1)) {
176 					bufl = l + 1;
177 					buf[bufl] = '\0';
178 				}
179 				if (type == 2) {
180 					add_next_index_stringl(array, buf, bufl, 1);
181 				}
182 			}
183 
184 			/* Return last line from the shell command */
185 			RETVAL_STRINGL(buf, bufl, 1);
186 		} else { /* should return NULL, but for BC we return "" */
187 			RETVAL_EMPTY_STRING();
188 		}
189 	} else {
190 		while((bufl = php_stream_read(stream, buf, EXEC_INPUT_BUF)) > 0) {
191 			PHPWRITE(buf, bufl);
192 		}
193 	}
194 
195 	pclose_return = php_stream_close(stream);
196 	efree(buf);
197 
198 done:
199 #if PHP_SIGCHILD
200 	if (sig_handler) {
201 		signal(SIGCHLD, sig_handler);
202 	}
203 #endif
204 	if (d) {
205 		efree(d);
206 	}
207 	return pclose_return;
208 err:
209 	pclose_return = -1;
210 	goto done;
211 }
212 /* }}} */
213 
php_exec_ex(INTERNAL_FUNCTION_PARAMETERS,int mode)214 static void php_exec_ex(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
215 {
216 	char *cmd;
217 	int cmd_len;
218 	zval *ret_code=NULL, *ret_array=NULL;
219 	int ret;
220 
221 	if (mode) {
222 		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|z/", &cmd, &cmd_len, &ret_code) == FAILURE) {
223 			RETURN_FALSE;
224 		}
225 	} else {
226 		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|z/z/", &cmd, &cmd_len, &ret_array, &ret_code) == FAILURE) {
227 			RETURN_FALSE;
228 		}
229 	}
230 	if (!cmd_len) {
231 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot execute a blank command");
232 		RETURN_FALSE;
233 	}
234 	if (strlen(cmd) != cmd_len) {
235 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "NULL byte detected. Possible attack");
236 		RETURN_FALSE;
237 	}
238 
239 	if (!ret_array) {
240 		ret = php_exec(mode, cmd, NULL, return_value TSRMLS_CC);
241 	} else {
242 		if (Z_TYPE_P(ret_array) != IS_ARRAY) {
243 			zval_dtor(ret_array);
244 			array_init(ret_array);
245 		}
246 		ret = php_exec(2, cmd, ret_array, return_value TSRMLS_CC);
247 	}
248 	if (ret_code) {
249 		zval_dtor(ret_code);
250 		ZVAL_LONG(ret_code, ret);
251 	}
252 }
253 /* }}} */
254 
255 /* {{{ proto string exec(string command [, array &output [, int &return_value]])
256    Execute an external program */
PHP_FUNCTION(exec)257 PHP_FUNCTION(exec)
258 {
259 	php_exec_ex(INTERNAL_FUNCTION_PARAM_PASSTHRU, 0);
260 }
261 /* }}} */
262 
263 /* {{{ proto int system(string command [, int &return_value])
264    Execute an external program and display output */
PHP_FUNCTION(system)265 PHP_FUNCTION(system)
266 {
267 	php_exec_ex(INTERNAL_FUNCTION_PARAM_PASSTHRU, 1);
268 }
269 /* }}} */
270 
271 /* {{{ proto void passthru(string command [, int &return_value])
272    Execute an external program and display raw output */
PHP_FUNCTION(passthru)273 PHP_FUNCTION(passthru)
274 {
275 	php_exec_ex(INTERNAL_FUNCTION_PARAM_PASSTHRU, 3);
276 }
277 /* }}} */
278 
279 /* {{{ php_escape_shell_cmd
280    Escape all chars that could possibly be used to
281    break out of a shell command
282 
283    This function emalloc's a string and returns the pointer.
284    Remember to efree it when done with it.
285 
286    *NOT* safe for binary strings
287 */
php_escape_shell_cmd(char * str)288 PHPAPI char *php_escape_shell_cmd(char *str)
289 {
290 	register int x, y;
291 	size_t l = strlen(str);
292 	uint64_t estimate = (2 * (uint64_t)l) + 1;
293 	char *cmd;
294 	char *p = NULL;
295 
296 	TSRMLS_FETCH();
297 
298 	/* max command line length - two single quotes - \0 byte length */
299 	if (l > cmd_max_len - 2 - 1) {
300 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Command exceeds the allowed length of %d bytes", cmd_max_len);
301 		return NULL;
302 	}
303 
304 	cmd = safe_emalloc(2, l, 1);
305 
306 	for (x = 0, y = 0; x < l; x++) {
307 		int mb_len = php_mblen(str + x, (l - x));
308 
309 		/* skip non-valid multibyte characters */
310 		if (mb_len < 0) {
311 			continue;
312 		} else if (mb_len > 1) {
313 			memcpy(cmd + y, str + x, mb_len);
314 			y += mb_len;
315 			x += mb_len - 1;
316 			continue;
317 		}
318 
319 		switch (str[x]) {
320 #ifndef PHP_WIN32
321 			case '"':
322 			case '\'':
323 				if (!p && (p = memchr(str + x + 1, str[x], l - x - 1))) {
324 					/* noop */
325 				} else if (p && *p == str[x]) {
326 					p = NULL;
327 				} else {
328 					cmd[y++] = '\\';
329 				}
330 				cmd[y++] = str[x];
331 				break;
332 #else
333 			/* % is Windows specific for enviromental variables, ^%PATH% will
334 				output PATH while ^%PATH^% will not. escapeshellcmd will escape all % and !.
335 			*/
336 			case '%':
337 			case '!':
338 			case '"':
339 			case '\'':
340 #endif
341 			case '#': /* This is character-set independent */
342 			case '&':
343 			case ';':
344 			case '`':
345 			case '|':
346 			case '*':
347 			case '?':
348 			case '~':
349 			case '<':
350 			case '>':
351 			case '^':
352 			case '(':
353 			case ')':
354 			case '[':
355 			case ']':
356 			case '{':
357 			case '}':
358 			case '$':
359 			case '\\':
360 			case '\x0A': /* excluding these two */
361 			case '\xFF':
362 #ifdef PHP_WIN32
363 				cmd[y++] = '^';
364 #else
365 				cmd[y++] = '\\';
366 #endif
367 				/* fall-through */
368 			default:
369 				cmd[y++] = str[x];
370 
371 		}
372 	}
373 	cmd[y] = '\0';
374 
375 	if (y > cmd_max_len + 1) {
376 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Escaped command exceeds the allowed length of %d bytes", cmd_max_len);
377 		efree(cmd);
378 		return NULL;
379 	}
380 
381 	if ((estimate - y) > 4096) {
382 		/* realloc if the estimate was way overill
383 		 * Arbitrary cutoff point of 4096 */
384 		cmd = erealloc(cmd, y + 1);
385 	}
386 
387 	return cmd;
388 }
389 /* }}} */
390 
391 /* {{{ php_escape_shell_arg
392  */
php_escape_shell_arg(char * str)393 PHPAPI char *php_escape_shell_arg(char *str)
394 {
395 	int x, y = 0;
396 	size_t l = strlen(str);
397 	char *cmd;
398 	uint64_t estimate = (4 * (uint64_t)l) + 3;
399 
400 	TSRMLS_FETCH();
401 
402 	/* max command line length - two single quotes - \0 byte length */
403 	if (l > cmd_max_len - 2 - 1) {
404 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Argument exceeds the allowed length of %d bytes", cmd_max_len);
405 		return NULL;
406 	}
407 
408 	cmd = safe_emalloc(4, l, 3); /* worst case */
409 
410 #ifdef PHP_WIN32
411 	cmd[y++] = '"';
412 #else
413 	cmd[y++] = '\'';
414 #endif
415 
416 	for (x = 0; x < l; x++) {
417 		int mb_len = php_mblen(str + x, (l - x));
418 
419 		/* skip non-valid multibyte characters */
420 		if (mb_len < 0) {
421 			continue;
422 		} else if (mb_len > 1) {
423 			memcpy(cmd + y, str + x, mb_len);
424 			y += mb_len;
425 			x += mb_len - 1;
426 			continue;
427 		}
428 
429 		switch (str[x]) {
430 #ifdef PHP_WIN32
431 		case '"':
432 		case '%':
433 		case '!':
434 			cmd[y++] = ' ';
435 			break;
436 #else
437 		case '\'':
438 			cmd[y++] = '\'';
439 			cmd[y++] = '\\';
440 			cmd[y++] = '\'';
441 #endif
442 			/* fall-through */
443 		default:
444 			cmd[y++] = str[x];
445 		}
446 	}
447 #ifdef PHP_WIN32
448 	if (y > 0 && '\\' == cmd[y - 1]) {
449 		int k = 0, n = y - 1;
450 		for (; n >= 0 && '\\' == cmd[n]; n--, k++);
451 		if (k % 2) {
452 			cmd[y++] = '\\';
453 		}
454 	}
455 
456 	cmd[y++] = '"';
457 #else
458 	cmd[y++] = '\'';
459 #endif
460 	cmd[y] = '\0';
461 
462 	if (y > cmd_max_len + 1) {
463 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Escaped argument exceeds the allowed length of %d bytes", cmd_max_len);
464 		efree(cmd);
465 		return NULL;
466 	}
467 
468 	if ((estimate - y) > 4096) {
469 		/* realloc if the estimate was way overill
470 		 * Arbitrary cutoff point of 4096 */
471 		cmd = erealloc(cmd, y + 1);
472 	}
473 	return cmd;
474 }
475 /* }}} */
476 
477 /* {{{ proto string escapeshellcmd(string command)
478    Escape shell metacharacters */
PHP_FUNCTION(escapeshellcmd)479 PHP_FUNCTION(escapeshellcmd)
480 {
481 	char *command;
482 	int command_len;
483 	char *cmd = NULL;
484 
485 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &command, &command_len) == FAILURE) {
486 		return;
487 	}
488 
489 	if (command_len) {
490 		if (command_len != strlen(command)) {
491 			php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input string contains NULL bytes");
492 			return;
493 		}
494 		cmd = php_escape_shell_cmd(command);
495 		RETVAL_STRINGL_CHECK(cmd, strlen(cmd), 0);
496 	} else {
497 		RETVAL_EMPTY_STRING();
498 	}
499 }
500 /* }}} */
501 
502 /* {{{ proto string escapeshellarg(string arg)
503    Quote and escape an argument for use in a shell command */
PHP_FUNCTION(escapeshellarg)504 PHP_FUNCTION(escapeshellarg)
505 {
506 	char *argument;
507 	int argument_len;
508 	char *cmd = NULL;
509 
510 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &argument, &argument_len) == FAILURE) {
511 		return;
512 	}
513 
514 	if (argument) {
515 		if (argument_len != strlen(argument)) {
516 			php_error_docref(NULL TSRMLS_CC, E_ERROR, "Input string contains NULL bytes");
517 			return;
518 		}
519 		cmd = php_escape_shell_arg(argument);
520 		RETVAL_STRINGL_CHECK(cmd, strlen(cmd), 0);
521 	}
522 }
523 /* }}} */
524 
525 /* {{{ proto string shell_exec(string cmd)
526    Execute command via shell and return complete output as string */
PHP_FUNCTION(shell_exec)527 PHP_FUNCTION(shell_exec)
528 {
529 	FILE *in;
530 	size_t total_readbytes;
531 	char *command;
532 	int command_len;
533 	char *ret;
534 	php_stream *stream;
535 
536 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &command, &command_len) == FAILURE) {
537 		return;
538 	}
539 
540 #ifdef PHP_WIN32
541 	if ((in=VCWD_POPEN(command, "rt"))==NULL) {
542 #else
543 	if ((in=VCWD_POPEN(command, "r"))==NULL) {
544 #endif
545 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to execute '%s'", command);
546 		RETURN_FALSE;
547 	}
548 
549 	stream = php_stream_fopen_from_pipe(in, "rb");
550 	total_readbytes = php_stream_copy_to_mem(stream, &ret, PHP_STREAM_COPY_ALL, 0);
551 	php_stream_close(stream);
552 
553 	if (total_readbytes > 0) {
554 		RETVAL_STRINGL_CHECK(ret, total_readbytes, 0);
555 	}
556 }
557 /* }}} */
558 
559 #ifdef HAVE_NICE
560 /* {{{ proto bool proc_nice(int priority)
561    Change the priority of the current process */
562 PHP_FUNCTION(proc_nice)
563 {
564 	long pri;
565 
566 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &pri) == FAILURE) {
567 		RETURN_FALSE;
568 	}
569 
570 	errno = 0;
571 	php_ignore_value(nice(pri));
572 	if (errno) {
573 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only a super user may attempt to increase the priority of a process");
574 		RETURN_FALSE;
575 	}
576 
577 	RETURN_TRUE;
578 }
579 /* }}} */
580 #endif
581 
582 /*
583  * Local variables:
584  * tab-width: 4
585  * c-basic-offset: 4
586  * End:
587  * vim600: sw=4 ts=4 fdm=marker
588  * vim<600: sw=4 ts=4
589  */
590