mirror of
git://slackware.nl/current.git
synced 2024-12-28 09:59:53 +01:00
63 lines
2.4 KiB
Diff
63 lines
2.4 KiB
Diff
|
From c0fceebfa195b8e56a7108cb731b5ea7afbef70c Mon Sep 17 00:00:00 2001
|
||
|
|
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
|
||
|
|
Date: Fri, 27 Jan 2023 19:28:27 +0100
|
||
|
|
Subject: [PATCH] Fix array overrun when appending slash to paths
|
||
|
|
|
||
|
|
Fix it by extending the array sizes by one character. As the input is
|
||
|
|
limited to the maximum path length, there will always be place to append
|
||
|
|
the slash. As the php_check_specific_open_basedir() simply uses the
|
||
|
|
strings to compare against each other, no new failures related to too
|
||
|
|
long paths are introduced.
|
||
|
|
We'll let the DOM and XML case handle a potentially too long path in the
|
||
|
|
library code.
|
||
|
|
---
|
||
|
|
ext/dom/document.c | 2 +-
|
||
|
|
ext/xmlreader/php_xmlreader.c | 2 +-
|
||
|
|
main/fopen_wrappers.c | 6 +++---
|
||
|
|
3 files changed, 5 insertions(+), 5 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/ext/dom/document.c b/ext/dom/document.c
|
||
|
|
index 4dee5548f188..c60198a3be11 100644
|
||
|
|
--- a/ext/dom/document.c
|
||
|
|
+++ b/ext/dom/document.c
|
||
|
|
@@ -1182,7 +1182,7 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, size_t so
|
||
|
|
int validate, recover, resolve_externals, keep_blanks, substitute_ent;
|
||
|
|
int resolved_path_len;
|
||
|
|
int old_error_reporting = 0;
|
||
|
|
- char *directory=NULL, resolved_path[MAXPATHLEN];
|
||
|
|
+ char *directory=NULL, resolved_path[MAXPATHLEN + 1];
|
||
|
|
|
||
|
|
if (id != NULL) {
|
||
|
|
intern = Z_DOMOBJ_P(id);
|
||
|
|
diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
|
||
|
|
index c17884d960cb..39141c8c1223 100644
|
||
|
|
--- a/ext/xmlreader/php_xmlreader.c
|
||
|
|
+++ b/ext/xmlreader/php_xmlreader.c
|
||
|
|
@@ -1017,7 +1017,7 @@ PHP_METHOD(XMLReader, XML)
|
||
|
|
xmlreader_object *intern = NULL;
|
||
|
|
char *source, *uri = NULL, *encoding = NULL;
|
||
|
|
int resolved_path_len, ret = 0;
|
||
|
|
- char *directory=NULL, resolved_path[MAXPATHLEN];
|
||
|
|
+ char *directory=NULL, resolved_path[MAXPATHLEN + 1];
|
||
|
|
xmlParserInputBufferPtr inputbfr;
|
||
|
|
xmlTextReaderPtr reader;
|
||
|
|
|
||
|
|
diff --git a/main/fopen_wrappers.c b/main/fopen_wrappers.c
|
||
|
|
index f6ce26e104be..12cc9c8b10c0 100644
|
||
|
|
--- a/main/fopen_wrappers.c
|
||
|
|
+++ b/main/fopen_wrappers.c
|
||
|
|
@@ -129,10 +129,10 @@ PHPAPI ZEND_INI_MH(OnUpdateBaseDir)
|
||
|
|
*/
|
||
|
|
PHPAPI int php_check_specific_open_basedir(const char *basedir, const char *path)
|
||
|
|
{
|
||
|
|
- char resolved_name[MAXPATHLEN];
|
||
|
|
- char resolved_basedir[MAXPATHLEN];
|
||
|
|
+ char resolved_name[MAXPATHLEN + 1];
|
||
|
|
+ char resolved_basedir[MAXPATHLEN + 1];
|
||
|
|
char local_open_basedir[MAXPATHLEN];
|
||
|
|
- char path_tmp[MAXPATHLEN];
|
||
|
|
+ char path_tmp[MAXPATHLEN + 1];
|
||
|
|
char *path_file;
|
||
|
|
size_t resolved_basedir_len;
|
||
|
|
size_t resolved_name_len;
|