Bug #68773 [NEW]: basename function does not check non-minimum UTF-8 forms

From: php at tokumaru dot org Operating system: Ubuntu PHP version: 5.6.4 Package: Filesystem function related Bug Type: Bug Bug description:basename function does not check non-minimum UTF-8 forms Description: ------------ Function basename does not check invalid multibyte strings. For example, non-minimum UTF-8 forms are treated as normal file names. This is a potential path-traversal vulnerability like CVE-2008-2938. Test script: --------------- setlocale('LC_CTYPE', 'en_US.utf8'); var_dump(bin2hex(basename("..\xC0\xAFx"))); // \xC0\xAF is a non-minimum UTF-8 form of '/' Expected result: ---------------- string(2) "78" OR string(0) "" Actual result: -------------- string(10) "2e2ec0af78" -- Edit bug report at https://bugs.php.net/bug.php?id=68773&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68773&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68773&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68773&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68773&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68773&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68773&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68773&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68773&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68773&r=support Expected behavior: https://bugs.php.net/fix.php?id=68773&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68773&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68773&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68773&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68773&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68773&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68773&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68773&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68773&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68773&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68773&r=mysqlcfg