cvs: php-src /ext/xmlreader php_xmlreader.c /ext/xmlwriter php_xmlwriter.c

nlopess Sat Sep 16 18:21:53 2006 UTC Modified files: /php-src/ext/xmlreader php_xmlreader.c /php-src/ext/xmlwriter php_xmlwriter.c Log: MFB http://cvs.php.net/viewvc.cgi/php-src/ext/xmlreader/php_xmlreader.c?r1=1.40&r2=1.41&diff_format=u Index: php-src/ext/xmlreader/php_xmlreader.c diff -u php-src/ext/xmlreader/php_xmlreader.c:1.40 php-src/ext/xmlreader/php_xmlreader.c:1.41 --- php-src/ext/xmlreader/php_xmlreader.c:1.40 Fri Aug 4 20:59:36 2006 +++ php-src/ext/xmlreader/php_xmlreader.c Sat Sep 16 18:21:53 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: php_xmlreader.c,v 1.40 2006/08/04 20:59:36 andrei Exp $ */ +/* $Id: php_xmlreader.c,v 1.41 2006/09/16 18:21:53 nlopess Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -259,9 +259,9 @@ file_dest = source; if ((uri->scheme == NULL || isFileUri)) { - /* XXX possible buffer overflow if VCWD_REALPATH does not know size of resolved_path */ - if (! VCWD_REALPATH(source, resolved_path)) { - expand_filepath(source, resolved_path TSRMLS_CC); + if (!VCWD_REALPATH(source, resolved_path) && !expand_filepath(source, resolved_path TSRMLS_CC)) { + xmlFreeURI(uri); + return NULL; } file_dest = resolved_path; } http://cvs.php.net/viewvc.cgi/php-src/ext/xmlwriter/php_xmlwriter.c?r1=1.37&r2=1.38&diff_format=u Index: php-src/ext/xmlwriter/php_xmlwriter.c diff -u php-src/ext/xmlwriter/php_xmlwriter.c:1.37 php-src/ext/xmlwriter/php_xmlwriter.c:1.38 --- php-src/ext/xmlwriter/php_xmlwriter.c:1.37 Fri Aug 25 18:56:03 2006 +++ php-src/ext/xmlwriter/php_xmlwriter.c Sat Sep 16 18:21:53 2006 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: php_xmlwriter.c,v 1.37 2006/08/25 18:56:03 rrichards Exp $ */ +/* $Id: php_xmlwriter.c,v 1.38 2006/09/16 18:21:53 nlopess Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -276,9 +276,9 @@ file_dest = source; if ((uri->scheme == NULL || isFileUri)) { - /* XXX possible buffer overflow if VCWD_REALPATH does not know size of resolved_path */ - if (! VCWD_REALPATH(source, resolved_path)) { - expand_filepath(source, resolved_path TSRMLS_CC); + if (!VCWD_REALPATH(source, resolved_path) && !expand_filepath(source, resolved_path TSRMLS_CC)) { + xmlFreeURI(uri); + return NULL; } file_dest = resolved_path; }