Re: PHP Annual Bughunt!

On Wed, 3 Jul 2002, Melvyn Sopacua wrote: > RE: pack 51/17791 > > Does it make sence for the php extension to 'guard' against this, even though > it's: > 1) a user error > 2) a Sablotron error > > On the other hand - a path+filename can in real life make up more than 512 > bytes. > > So - it should probably be a patch on both sides, where a constant is > defined or > used from an os header, for the max length of a filename. I don't think PHP should guard for this, because it's a problem in the sablotron API. I don't like this kind of 'workarounds', if we do this for everything, we'll end up having PHP as one big workaround :) Derick > > I was thinking along the lines of: > Index: sablot.c > =================================================================== > RCS file: /repository/php4/ext/xslt/sablot.c,v > retrieving revision 1.48 > diff -u -r1.48 sablot.c > --- sablot.c 29 Jun 2002 01:55:34 -0000 1.48 > +++ sablot.c 2 Jul 2002 22:51:05 -0000 > @@ -37,6 +37,10 @@ > #include <sys/stat.h> > #include <fcntl.h> > > +#ifndef SABLOT_MAX_FILENAME_LEN > + #define SABLOT_MAX_FILENAME_LEN 512 > +#endif > + > /* functions relating to handlers */ > static void register_sax_handler_pair(zval **, zval **, zval **); > > @@ -495,6 +499,12 @@ > else { > convert_to_string_ex(result_p); > result = Z_STRVAL_PP(result_p); > + } > + > + if (argc == 3) { > + if(sizeof(xml) > SABLOT_MAX_FILENAME_LEN || sizeof(xslt) > > SABLOT_MAX_FILENAME_LEN ) { > + RETURN_FALSE; > + } > } > > /* Translate a PHP array into a Sablotron array */ > > > > > > > Met vriendelijke groeten / With kind regards, > > IDG.nl > Melvyn Sopacua > Webmaster > > > -- > PHP Quality Assurance Mailing List <http://www.php.net/> > To unsubscribe, visit: http://www.php.net/unsub.php > --------------------------------------------------------------------------- Did I help you? http://www.derickrethans.nl/link.php?url=giftlist Frequent ranting: http://www.derickrethans.nl/ --------------------------------------------------------------------------- PHP: Scripting the Web - derick@php.net All your branches are belong to me! SRM: Script Running Machine - www.vl-srm.net ---------------------------------------------------------------------------