View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001189 | Xdebug | Uncategorized | public | 2015-09-25 13:28 | 2015-12-07 11:32 |
| Reporter | techkey | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Platform | Windows x64 | OS | Microsoft Windows 10 Pro | OS Version | 10.0.10240 Build |
| Target Version | 2.4.1 | Fixed in Version | 2.4.0rc2 | ||
| Summary | 0001189: Remove address attribute from remote debugging responses, as they sometimes get negative and expose potential security issues | ||||
| Description | Tests (e.g. bug00421.phpt) that check XML returns negative addresses in the address attribute. | ||||
| Steps To Reproduce | Run tests that check XML and look at the addresses. | ||||
| Additional Information | Has this to do with lines like: xdebug_xml_add_attribute_ex(node, "address", xdebug_sprintf("%ld", (long) val), 0, 1); in xdebug_var.c? Note the 'd' (signed integer) in "%ld". Negative address values are not filtered out in line 49 of dbgpclient.php (addresses shouldn't be negative in the first place). This happens in PHP5.6.13 with xdebug 2.3.3.1 (downloaded dll and built from source) and PHP7 with xdebug master (built from source). | ||||
| Tags | No tags attached. | ||||
| Operating System | Microsoft Windows 10 Pro 10.0.10240 Build 10240 x64 | ||||
| PHP Version | 5.1.0 | ||||
