Search
j0ke.net Open Build Service
>
Projects
>
home:netmax
:
rebuilds
>
php4
> php-4.3.9-CVE-2006-1494.patch
Sign Up
|
Log In
Username
Password
Cancel
Overview
Repositories
Revisions
Requests
Users
Advanced
Attributes
Meta
File php-4.3.9-CVE-2006-1494.patch of Package php4
--- php-4.3.9/ext/standard/file.c.cve1494 +++ php-4.3.9/ext/standard/file.c @@ -555,7 +555,7 @@ pval **arg1, **arg2; char *d; char *opened_path; - char p[64]; + char *p; FILE *fp; if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) { @@ -569,7 +569,11 @@ } d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1)); - strlcpy(p, Z_STRVAL_PP(arg2), sizeof(p)); + + p = php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0); + if (strlen(p) > 64) { + p[63] = '\0'; + } if ((fp = php_open_temporary_file(d, p, &opened_path TSRMLS_CC))) { fclose(fp); @@ -577,6 +581,7 @@ } else { RETVAL_FALSE; } + efree(p); efree(d); } /* }}} */