[php-src] PR #24248: Fix GH-21992: symlink() creates link at dangling symlink target
| From: | bukka | Date: | Sat, 10 Oct 2026 20:01:20 +0000 |
| Subject: | [php-src] PR #24248: Fix GH-21992: symlink() creates link at dangling symlink target | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39326@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24248
Author: bukka
Fixes #21992.
expand_filepath() resolves the last component of the link path, so when it is an
existing dangling symlink, the new link is silently created at the symlink target and
symlink() returns true. link() has the same problem.
This resolves only the directory part of the link path and keeps the last component as given, so the
kernel reports EEXIST for any existing entry (including a dangling symlink) and the
usual "File exists" warning is emitted. No extra pre-check is needed, so there is no race
between the check and the link creation.
Supersedes #22024, which added an lstat/stat pre-check instead of fixing
the path resolution and did not cover link().