mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 18:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #69511 Off-by-one bufferoverflow in php_sys_readlink

Browse Source
This commit is contained in:
Anatol Belski 2015-05-19 15:44:55 +02:00
parent eebab8282b
commit 890a28d4b9
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -78,6 +78,8 @@
. Implemented the RFC `Fix "foreach" behavior`. (Dmitry)
. Implemented the RFC `Generator Delegation`. (Bob)
. Implemented the RFC ` Anonymous Class Support`. (Joe, Nikita, Dmitry)
. Fixed bug #69511 (Off-by-one buffer overflow in php_sys_readlink).
(Jan Starke, Anatol)
- Curl:
. Fixed bug #68937 (Segfault in curl_multi_exec). (Laruence)

14
Zend/zend_virtual_cwd.c
View File

@ -237,6 +237,10 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){
typedef BOOL (WINAPI *gfpnh_func)(HANDLE, LPTSTR, DWORD, DWORD);
gfpnh_func pGetFinalPathNameByHandle;
if (!target_len) {
return -1;
}
kernel32 = LoadLibrary("kernel32.dll");
if (kernel32) {
@ -260,8 +264,14 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){
return -1;
}
dwRet = pGetFinalPathNameByHandle(hFile, target, MAXPATHLEN, VOLUME_NAME_DOS);
if(dwRet >= MAXPATHLEN || dwRet == 0) {
/* Despite MSDN has documented it won't to, the length returned by
GetFinalPathNameByHandleA includes the length of the
null terminator. This behavior is at least reproducible
with VS2012 and earlier, and seems not to be fixed till
now. Thus, correcting target_len so it's suddenly don't
overflown. */
dwRet = pGetFinalPathNameByHandle(hFile, target, target_len - 1, VOLUME_NAME_DOS);
if(dwRet >= target_len || dwRet >= MAXPATHLEN || dwRet == 0) {
return -1;
}