iliaa Mon Mar 27 23:40:41 2006 UTC
Modified files: (Branch: PHP_5_1)
/php-src NEWS
/php-src/ext/standard file.c
Log:
Check 2nd parameter of tempnam() against path components.
http://cvs.php.net/viewcvs.cgi/php-src/NEWS?r1=1.2027.2.484&r2=1.2027.2.485&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.484 php-src/NEWS:1.2027.2.485
--- php-src/NEWS:1.2027.2.484 Mon Mar 27 22:07:37 2006
+++ php-src/NEWS Mon Mar 27 23:40:41 2006
@@ -1,6 +1,7 @@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? Mar 2006, PHP 5.1.3RC2
+- Check 2nd parameter of tempnam() against path components. (Ilia)
- Fixed Apache2 SAPIs header handler modifying header strings. (Mike)
- Allowed 'auto_globals_jit' work together with 'register_argc_argv'. (Dmitry)
- Eliminated run-time constant fetching for TRUE, FALSE and NULL. (Dmitry)
http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/file.c?r1=1.409.2.4&r2=1.409.2.5&diff_format=u
Index: php-src/ext/standard/file.c
diff -u php-src/ext/standard/file.c:1.409.2.4
php-src/ext/standard/file.c:1.409.2.5
--- php-src/ext/standard/file.c:1.409.2.4 Fri Jan 13 04:05:59 2006
+++ php-src/ext/standard/file.c Mon Mar 27 23:40:41 2006
@@ -21,7 +21,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: file.c,v 1.409.2.4 2006/01/13 04:05:59 pajoye Exp $ */
+/* $Id: file.c,v 1.409.2.5 2006/03/27 23:40:41 iliaa Exp $ */
/* Synced with php 3.0 revision 1.218 1999-06-16 [ssb] */
@@ -773,8 +773,9 @@
zval **arg1, **arg2;
char *d;
char *opened_path;
- char p[64];
+ char *p;
int fd;
+ size_t p_len;
if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) ==
FAILURE) {
WRONG_PARAM_COUNT;
@@ -787,7 +788,11 @@
}
d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1));
- strlcpy(p, Z_STRVAL_PP(arg2), sizeof(p));
+
+ php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len
TSRMLS_CC);
+ if (p_len > 64) {
+ p[63] = '\0';
+ }
if ((fd = php_open_temporary_fd(d, p, &opened_path TSRMLS_CC)) >= 0) {
close(fd);
@@ -795,6 +800,7 @@
} else {
RETVAL_FALSE;
}
+ efree(p);
efree(d);
}
/* }}} */
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
