cvs: php-src(PHP_4_4) /ext/standard file.c

iliaa Mon Mar 27 23:42:22 2006 UTC Modified files: (Branch: PHP_4_4) /php-src/ext/standard file.c Log: MFH: Check 2nd parameter of tempnam() against path components. http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/file.c?r1=1.279.2.70.2.4&r2=1.279.2.70.2.5&diff_format=u Index: php-src/ext/standard/file.c diff -u php-src/ext/standard/file.c:1.279.2.70.2.4 php-src/ext/standard/file.c:1.279.2.70.2.5 --- php-src/ext/standard/file.c:1.279.2.70.2.4 Wed Feb 1 10:32:38 2006 +++ php-src/ext/standard/file.c Mon Mar 27 23:42:22 2006 @@ -21,7 +21,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: file.c,v 1.279.2.70.2.4 2006/02/01 10:32:38 tony2001 Exp $ */ +/* $Id: file.c,v 1.279.2.70.2.5 2006/03/27 23:42:22 iliaa Exp $ */ /* Synced with php 3.0 revision 1.218 1999-06-16 [ssb] */ @@ -552,8 +552,9 @@ pval **arg1, **arg2; char *d; char *opened_path; - char p[64]; + char *p; FILE *fp; + size_t p_len; if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) { WRONG_PARAM_COUNT; @@ -566,7 +567,11 @@ } d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1)); - strlcpy(p, Z_STRVAL_PP(arg2), sizeof(p)); + + php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len TSRMLS_CC); + if (p_len > 64) { + p[63] = '\0'; + } if ((fp = php_open_temporary_file(d, p, &opened_path TSRMLS_CC))) { fclose(fp); @@ -574,6 +579,7 @@ } else { RETVAL_FALSE; } + efree(p); efree(d); } /* }}} */