From 6c7587ae29653ec30b7bbba23024ca9cb7eea0ab Mon Sep 17 00:00:00 2001 From: Darian Anthony Patrick Date: Mon, 25 Apr 2016 10:57:57 -0700 Subject: [PATCH] Skip shell invocation on large input Add a sanity check to the math extension that skips shelling out to texvc if the input is insanely large. Bug: T129506 Change-Id: Ifb697a33f07aea72a8a7eb7ed1499d144872b206 --- MathInputCheckTexvc.php | 5 +++++ MathTexvc.php | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/MathInputCheckTexvc.php b/MathInputCheckTexvc.php index 5845a7d..bd7de73 100644 --- a/MathInputCheckTexvc.php +++ b/MathInputCheckTexvc.php @@ -77,6 +77,11 @@ class MathInputCheckTexvc extends MathInputCheck { } LoggerFactory::getInstance( 'Math' )->debug( "TeX check command: $cmd" ); + if ( strlen( $cmd ) > SHELL_MAX_ARG_STRLEN ) { + LoggerFactory::getInstance( 'Math' )->error( + "User input exceeded SHELL_MAX_ARG_STRLEN." ); + return $this->convertTexvcError(''); + } $contents = wfShellExec( $cmd ); LoggerFactory::getInstance( 'Math' )->debug( "TeX check result: $contents\n---" ); diff --git a/MathTexvc.php b/MathTexvc.php index 70f351c..1d2fc41 100644 --- a/MathTexvc.php +++ b/MathTexvc.php @@ -201,6 +201,11 @@ class MathTexvc extends MathRenderer { LoggerFactory::getInstance( 'Math' )->debug( "TeX: $cmd" ); LoggerFactory::getInstance( 'Math' )->debug( "Executing '$cmd'." ); $retval = null; + if ( strlen( $cmd ) > SHELL_MAX_ARG_STRLEN ) { + LoggerFactory::getInstance( 'Math' )->error( + "User input exceeded SHELL_MAX_ARG_STRLEN." ); + return $this->getError( 'math_unknown_error' ); + } $contents = wfShellExec( $cmd, $retval ); LoggerFactory::getInstance( 'Math' )->debug( "TeX output:\n $contents\n---" ); -- 2.5.4 (Apple Git-61)