#33329 [NEW]: big leak with readdir

From: jbriscoe at gmail dot com Operating system: windows - all PHP version: 5.0.3 PHP Bug Type: Directory function related Bug description: big leak with readdir Description: ------------ I couldnt find anyone who has reported this before, but there is a big leak with the readdir function. I was playing with the code and found that you can use is to read the root directory, or any dir for that matter, that is a security risk!!!!!! here is the code - Hope this helps fix the problem. Reproduce code: --------------- function GetDirContents($dir){ ini_set("max_execution_time",10); if (!is_dir($dir)){die ("OOps");} if ($root=@opendir($dir)){ while ($file=readdir($root)){ if($file=="." || $file==".."){continue;} $files[]=$dir.$file; for($x=0; $x<sizeof($files);$x++) print $files[$x]<br>"; } } return $files; } Expected result: ---------------- It will print all of the directories and files depending on the input.(even the root!!!) Actual result: -------------- It will print all of the directories and files depending on the input.(even the root!!!) -- Edit bug report at http://bugs.php.net/?id=33329&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=33329&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=33329&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=33329&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=33329&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=33329&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=33329&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=33329&r=needscript Try newer version: http://bugs.php.net/fix.php?id=33329&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=33329&r=support Expected behavior: http://bugs.php.net/fix.php?id=33329&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=33329&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=33329&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=33329&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=33329&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=33329&r=dst IIS Stability: http://bugs.php.net/fix.php?id=33329&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=33329&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=33329&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=33329&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=33329&r=mysqlcfg