com php-src: make length check more robust: Zend/zend_virtual _cwd.c

Commit: 403f3524820a6bfef5873e88f258bf5aafe33ed7 Author: Anatol Belski <ab@php.net> Tue, 24 Jan 2017 13:24:11 +0100 Parents: 9aad38038e8bd41b9bf89c00804943509e10fe1a Branches: PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=403f3524820a6bfef5873e88f258bf5aafe33ed7 Log: make length check more robust Changed paths: M Zend/zend_virtual_cwd.c Diff: diff --git a/Zend/zend_virtual_cwd.c b/Zend/zend_virtual_cwd.c index 5a0b149..0f388dc 100644 --- a/Zend/zend_virtual_cwd.c +++ b/Zend/zend_virtual_cwd.c @@ -965,7 +965,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i #endif substitutename_len = pbuffer->MountPointReparseBuffer.SubstituteNameLength / sizeof(WCHAR); - if (substitutename_len > MAXPATHLEN) { + if (substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); FREE_PATHW() @@ -974,9 +974,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength); tmpsubstname[substitutename_len] = L'\0'; substitutename = php_win32_cp_conv_w_to_any(tmpsubstname, substitutename_len, &substitutename_len); - if (!substitutename) { + if (!substitutename || substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); + free(substitutename); #if VIRTUAL_CWD_DEBUG free(printname); #endif @@ -999,7 +1000,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i substitutename_len = pbuffer->MountPointReparseBuffer.SubstituteNameLength / sizeof(WCHAR); - if (substitutename_len > MAXPATHLEN) { + if (substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); FREE_PATHW() @@ -1008,9 +1009,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength); tmpsubstname[substitutename_len] = L'\0'; substitutename = php_win32_cp_conv_w_to_any(tmpsubstname, substitutename_len, &substitutename_len); - if (!substitutename) { + if (!substitutename || substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); + free(substitutename); #if VIRTUAL_CWD_DEBUG free(printname); #endif