#33329 [Opn->Bgs]: big leak with readdir

ID: 33329 Updated by: iliaa@php.net Reported By: jbriscoe at gmail dot com -Status: Open +Status: Bogus Bug Type: Directory function related Operating System: windows - all PHP Version: 5.0.3 New Comment: Wow, you've read the manual, bravo! Previous Comments: ------------------------------------------------------------------------ [2005-06-14 02:27:27] jbriscoe at gmail dot com Description: ------------ I couldnt find anyone who has reported this before, but there is a big leak with the readdir function. I was playing with the code and found that you can use is to read the root directory, or any dir for that matter, that is a security risk!!!!!! here is the code - Hope this helps fix the problem. Reproduce code: --------------- function GetDirContents($dir){ ini_set("max_execution_time",10); if (!is_dir($dir)){die ("OOps");} if ($root=@opendir($dir)){ while ($file=readdir($root)){ if($file=="." || $file==".."){continue;} $files[]=$dir.$file; for($x=0; $x<sizeof($files);$x++) print $files[$x]<br>"; } } return $files; } Expected result: ---------------- It will print all of the directories and files depending on the input.(even the root!!!) Actual result: -------------- It will print all of the directories and files depending on the input.(even the root!!!) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=33329&edit=1