|
 |
925b0d |
Patch cleanup for 5.6.5
|
|
|
925b0d |
|
|
|
925b0d |
From 6dedeb40db13971af45276f80b5375030aa7e76f Mon Sep 17 00:00:00 2001
|
|
|
925b0d |
From: Stanislav Malyshev <stas@php.net>
|
|
|
925b0d |
Date: Sat, 4 Jul 2015 23:47:48 -0700
|
|
|
925b0d |
Subject: [PATCH] Fix bug #69923 - Buffer overflow and stack smashing error in
|
|
|
925b0d |
phar_fix_filepath
|
|
|
925b0d |
|
|
|
925b0d |
---
|
|
|
925b0d |
ext/phar/phar.c | 10 ++++++++--
|
|
|
925b0d |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
925b0d |
|
|
|
925b0d |
diff --git a/ext/phar/phar.c b/ext/phar/phar.c
|
|
|
925b0d |
index 223bfe8..ba73462 100644
|
|
|
925b0d |
--- a/ext/phar/phar.c
|
|
|
925b0d |
+++ b/ext/phar/phar.c
|
|
|
925b0d |
@@ -2118,7 +2118,7 @@ char *tsrm_strtok_r(char *s, const char *delim, char **last) /* {{{ */
|
|
|
925b0d |
*/
|
|
|
925b0d |
char *phar_fix_filepath(char *path, int *new_len, int use_cwd TSRMLS_DC) /* {{{ */
|
|
|
925b0d |
{
|
|
|
925b0d |
- char newpath[MAXPATHLEN];
|
|
|
925b0d |
+ char *newpath;
|
|
|
925b0d |
int newpath_len;
|
|
|
925b0d |
char *ptr;
|
|
|
925b0d |
char *tok;
|
|
|
925b0d |
@@ -2126,8 +2126,10 @@ char *phar_fix_filepath(char *path, int *new_len, int use_cwd TSRMLS_DC) /* {{{
|
|
|
925b0d |
|
|
|
925b0d |
if (PHAR_G(cwd_len) && use_cwd && path_length > 2 && path[0] == '.' && path[1] == '/') {
|
|
|
925b0d |
newpath_len = PHAR_G(cwd_len);
|
|
|
925b0d |
+ newpath = emalloc(strlen(path) + newpath_len + 1);
|
|
|
925b0d |
memcpy(newpath, PHAR_G(cwd), newpath_len);
|
|
|
925b0d |
} else {
|
|
|
925b0d |
+ newpath = emalloc(strlen(path) + 2);
|
|
|
925b0d |
newpath[0] = '/';
|
|
|
925b0d |
newpath_len = 1;
|
|
|
925b0d |
}
|
|
|
925b0d |
@@ -2150,6 +2152,7 @@ char *phar_fix_filepath(char *path, int *new_len, int use_cwd TSRMLS_DC) /* {{{
|
|
|
925b0d |
if (*tok == '.') {
|
|
|
925b0d |
efree(path);
|
|
|
925b0d |
*new_len = 1;
|
|
|
925b0d |
+ efree(newpath);
|
|
|
925b0d |
return estrndup("/", 1);
|
|
|
925b0d |
}
|
|
|
925b0d |
break;
|
|
|
925b0d |
@@ -2157,9 +2160,11 @@ char *phar_fix_filepath(char *path, int *new_len, int use_cwd TSRMLS_DC) /* {{{
|
|
|
925b0d |
if (tok[0] == '.' && tok[1] == '.') {
|
|
|
925b0d |
efree(path);
|
|
|
925b0d |
*new_len = 1;
|
|
|
925b0d |
+ efree(newpath);
|
|
|
925b0d |
return estrndup("/", 1);
|
|
|
925b0d |
}
|
|
|
925b0d |
}
|
|
|
925b0d |
+ efree(newpath);
|
|
|
925b0d |
return path;
|
|
|
925b0d |
}
|
|
|
925b0d |
|
|
|
925b0d |
@@ -2208,7 +2213,8 @@ last_time:
|
|
|
925b0d |
|
|
|
925b0d |
efree(path);
|
|
|
925b0d |
*new_len = newpath_len;
|
|
|
925b0d |
- return estrndup(newpath, newpath_len);
|
|
|
925b0d |
+ newpath[newpath_len] = '\0';
|
|
|
925b0d |
+ return erealloc(newpath, newpath_len + 1);
|
|
|
925b0d |
}
|
|
|
925b0d |
/* }}} */
|
|
|
925b0d |
|
|
|
925b0d |
--
|
|
|
925b0d |
2.1.4
|
|
|
925b0d |
|