Bug #75686 [Opn->Nab]: coding bug

Edit report at https://bugs.php.net/bug.php?id=75686&edit=1 ID: 75686 Updated by: requinix@php.net Reported by: yangx92 at hotmail dot com Summary: coding bug -Status: Open +Status: Not a bug Type: Bug Package: XML Writer Operating System: Linux PHP Version: master-Git-2017-12-14 (Git) Block user comment: N Private report: N New Comment: Path length is checked during VCWD_REALPATH. Previous Comments: ------------------------------------------------------------------------ [2017-12-14 12:19:04] yangx92 at hotmail dot com Description: ------------ There is a coding bug in _xmlwriter_get_valid_file_path function in ext/xmlwriter/php_xmlwriter.c. >>> char file_dirname[MAXPATHLEN]; size_t dir_len; if (!VCWD_REALPATH(source, resolved_path) && !expand_filepath(source, resolved_path)) { xmlFreeURI(uri); return NULL; } memcpy(file_dirname, source, strlen(source)); >>> As code showed above, I think there should be a check for strlen(source) and MAXPATHLEN. If strlen(source) >= MAXPATHLEN, there will be a buffer overflow. Test script: --------------- None Expected result: ---------------- None Actual result: -------------- None ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75686&edit=1