cvs: php4 /ext/odbc php_odbc.c
| From: | Dan Kalowsky | Date: | Fri, 15 Feb 2002 17:24:46 +0000 |
| Subject: | cvs: php4 /ext/odbc php_odbc.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-9388@lists.php.net to get a copy of this message | ||
kalowsky Fri Feb 15 12:24:46 2002 EDT
Modified files:
/php4/ext/odbc php_odbc.c
Log:
fix for bug 15516, patch submitted by torben@php.net
Index: php4/ext/odbc/php_odbc.c
diff -u php4/ext/odbc/php_odbc.c:1.115 php4/ext/odbc/php_odbc.c:1.116
--- php4/ext/odbc/php_odbc.c:1.115 Wed Jan 30 16:54:54 2002
+++ php4/ext/odbc/php_odbc.c Fri Feb 15 12:24:44 2002
@@ -20,7 +20,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: php_odbc.c,v 1.115 2002/01/30 21:54:54 kalowsky Exp $ */
+/* $Id: php_odbc.c,v 1.116 2002/02/15 17:24:44 kalowsky Exp $ */
#ifdef HAVE_CONFIG_H
#include "config.h"
@@ -943,10 +943,21 @@
else
ctype = SQL_C_CHAR;
- if (Z_STRVAL_PP(tmp)[0] == '\'' &&
+ if (Z_STRLEN_PP(tmp) > 2 &&
+ Z_STRVAL_PP(tmp)[0] == '\'' &&
Z_STRVAL_PP(tmp)[Z_STRLEN_PP(tmp) - 1] == '\'') {
- filename = &Z_STRVAL_PP(tmp)[1];
- filename[Z_STRLEN_PP(tmp) - 2] = '\0';
+ filename = estrndup(&Z_STRVAL_PP(tmp)[1], Z_STRLEN_PP(tmp) - 2);
+ filename[strlen(filename)] = '\0';
+
+ /* Check for safe mode. */
+ if (PG(safe_mode) && (!php_checkuid(filename, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
+ RETURN_FALSE;
+ }
+
+ /* Check the basedir */
+ if (php_check_open_basedir(filename TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
if ((params[i-1].fp = open(filename,O_RDONLY)) == -1) {
php_error(E_WARNING,"Can't open file %s", filename);
@@ -957,8 +968,11 @@
}
}
efree(params);
+ efree(filename);
RETURN_FALSE;
}
+
+ efree(filename);
params[i-1].vallen = SQL_LEN_DATA_AT_EXEC(0);