From f106c084cbfb944b1f049d9222a6eeec1a88e6b8 Mon Sep 17 00:00:00 2001 From: Darian Anthony Patrick Date: Tue, 19 Apr 2016 10:29:10 -0700 Subject: [PATCH] Skip shell invocation on large input Add a sanity check to the math extension that skips shelling out to texvc if the input is insanely large. Bug: T129506 Change-Id: I2c7b6561464bddb4c3eab9230fa8168b24adaa37 --- MathInputCheckTexvc.php | 5 +++++ MathTexvc.php | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/MathInputCheckTexvc.php b/MathInputCheckTexvc.php index 59849d6..6a09a3c 100644 --- a/MathInputCheckTexvc.php +++ b/MathInputCheckTexvc.php @@ -83,6 +83,11 @@ class MathInputCheckTexvc extends MathInputCheck { } LoggerFactory::getInstance( 'Math' )->debug( "TeX check command: $cmd" ); + if ( strlen( $cmd ) > SHELL_MAX_ARG_STRLEN ) { + LoggerFactory::getInstance( 'Math' )->error( + "User input exceeded SHELL_MAX_ARG_STRLEN." ); + return $this->getError( 'math_unknown_error' ); + } $contents = wfShellExec( $cmd ); LoggerFactory::getInstance( 'Math' )->debug( "TeX check result: $contents\n---" ); diff --git a/MathTexvc.php b/MathTexvc.php index 7369c9f..131dbf4 100644 --- a/MathTexvc.php +++ b/MathTexvc.php @@ -206,6 +206,11 @@ class MathTexvc extends MathRenderer { LoggerFactory::getInstance( 'Math' )->debug( "TeX: $cmd" ); LoggerFactory::getInstance( 'Math' )->debug( "Executing '$cmd'." ); $retval = null; + if ( strlen( $cmd ) > SHELL_MAX_ARG_STRLEN ) { + LoggerFactory::getInstance( 'Math' )->error( + "User input exceeded SHELL_MAX_ARG_STRLEN." ); + return $this->getError( 'math_unknown_error' ); + } $contents = wfShellExec( $cmd, $retval ); LoggerFactory::getInstance( 'Math' )->debug( "TeX output:\n $contents\n---" ); -- 2.5.4 (Apple Git-61)