From a18cec1b865994735e5b4ab757ccc1a14f8607ff Mon Sep 17 00:00:00 2001
From: Boro Sitnikovski <buritomath@yahoo.com>
Date: Mon, 14 Apr 2014 10:02:11 +0200
Subject: [PATCH] Fix bug #65701: Do not use cache for file file copy

---
 NEWS                                  |  9 ++---
 ext/standard/file.c                   |  2 +-
 ext/standard/tests/file/bug65701.phpt | 30 +++++++++++++++++
 main/php_streams.h                    |  1 +
 main/streams/streams.c                | 48 +++++++++++++++------------
 5 files changed, 63 insertions(+), 27 deletions(-)
 create mode 100644 ext/standard/tests/file/bug65701.phpt

diff --git a/NEWS b/NEWS
index 2ba98b0b0fc..d9f0f8a353c 100644
--- a/NEWS
+++ b/NEWS
@@ -2,14 +2,15 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2014, PHP 5.4.29
 
+- Core:
+  . Fixed bug #65701 (copy() doesn't work when destination filename is created 
+    by tempnam()). (Boro Sitnikovski)
+  . Fixed bug #67072 (Echoing unserialized "SplFileObject" crash). (Anatol)
+
 - DOM:
   . Fixed bug #67081 (DOMDocumentType->internalSubset returns entire DOCTYPE tag,
     not only the subset). (Anatol)
 
-- Standard:
-  . Fixed bug #67072 (Echoing unserialized "SplFileObject" crash). (Anatol)
-
-
 ?? ??? 2014, PHP 5.4.28
 
 - Core:
diff --git a/ext/standard/file.c b/ext/standard/file.c
index c17e1f38e19..6bcaef78ca9 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1657,7 +1657,7 @@ PHPAPI int php_copy_file_ctx(char *src, char *dest, int src_flg, php_stream_cont
 		return FAILURE;
 	}
 
-	switch (php_stream_stat_path_ex(dest, PHP_STREAM_URL_STAT_QUIET, &dest_s, ctx)) {
+	switch (php_stream_stat_path_ex(dest, PHP_STREAM_URL_STAT_QUIET | PHP_STREAM_URL_STAT_NOCACHE, &dest_s, ctx)) {
 		case -1:
 			/* non-statable stream */
 			goto safe_to_copy;
diff --git a/ext/standard/tests/file/bug65701.phpt b/ext/standard/tests/file/bug65701.phpt
new file mode 100644
index 00000000000..2b1b5d491df
--- /dev/null
+++ b/ext/standard/tests/file/bug65701.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Test for bug #65701: copy() doesn't work when destination filename is created by tempnam()
+--CREDITS--
+Boro Sitnikovski <buritomath@yahoo.com>
+--FILE--
+<?php
+$file_path = dirname(__FILE__) . "/bug65701/";
+
+mkdir($file_path);
+
+$src = $file_path . '/srcbug65701_file.txt';
+$dst = tempnam($file_path, 'dstbug65701_file.txt');
+
+file_put_contents($src, "Hello World");
+
+copy($src, $dst);
+var_dump(filesize($dst));
+?>
+--CLEAN--
+<?php
+$file_path = dirname(__FILE__) . "/bug65701/";
+foreach (scandir($file_path) as $file) {
+    if (strpos($file, "bug65701") !== false) {
+        unlink($file_path . $file);
+    }
+}
+rmdir($file_path);
+?>
+--EXPECT--
+int(11)
diff --git a/main/php_streams.h b/main/php_streams.h
index f3c9879144b..2e4a3a2a18c 100644
--- a/main/php_streams.h
+++ b/main/php_streams.h
@@ -377,6 +377,7 @@ END_EXTERN_C()
 /* Flags for url_stat method in wrapper ops */
 #define PHP_STREAM_URL_STAT_LINK	1
 #define PHP_STREAM_URL_STAT_QUIET	2
+#define PHP_STREAM_URL_STAT_NOCACHE	4
 
 /* change the blocking mode of stream: value == 1 => blocking, value == 0 => non-blocking. */
 #define PHP_STREAM_OPTION_BLOCKING	1
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 12833771c02..3fd4ab37968 100644
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1929,16 +1929,18 @@ PHPAPI int _php_stream_stat_path(char *path, int flags, php_stream_statbuf *ssb,
 	char *path_to_open = path;
 	int ret;
 
-	/* Try to hit the cache first */
-	if (flags & PHP_STREAM_URL_STAT_LINK) {
-		if (BG(CurrentLStatFile) && strcmp(path, BG(CurrentLStatFile)) == 0) {
-			memcpy(ssb, &BG(lssb), sizeof(php_stream_statbuf));
-			return 0;
-		}
-	} else {
-		if (BG(CurrentStatFile) && strcmp(path, BG(CurrentStatFile)) == 0) {
-			memcpy(ssb, &BG(ssb), sizeof(php_stream_statbuf));
-			return 0;
+	if (!(flags & PHP_STREAM_URL_STAT_NOCACHE)) {
+		/* Try to hit the cache first */
+		if (flags & PHP_STREAM_URL_STAT_LINK) {
+			if (BG(CurrentLStatFile) && strcmp(path, BG(CurrentLStatFile)) == 0) {
+				memcpy(ssb, &BG(lssb), sizeof(php_stream_statbuf));
+				return 0;
+			}
+		} else {
+			if (BG(CurrentStatFile) && strcmp(path, BG(CurrentStatFile)) == 0) {
+				memcpy(ssb, &BG(ssb), sizeof(php_stream_statbuf));
+				return 0;
+			}
 		}
 	}
 
@@ -1946,19 +1948,21 @@ PHPAPI int _php_stream_stat_path(char *path, int flags, php_stream_statbuf *ssb,
 	if (wrapper && wrapper->wops->url_stat) {
 		ret = wrapper->wops->url_stat(wrapper, path_to_open, flags, ssb, context TSRMLS_CC);
 		if (ret == 0) {
-			/* Drop into cache */
-			if (flags & PHP_STREAM_URL_STAT_LINK) {
-				if (BG(CurrentLStatFile)) {
-					efree(BG(CurrentLStatFile));
+		        if (!(flags & PHP_STREAM_URL_STAT_NOCACHE)) {
+				/* Drop into cache */
+				if (flags & PHP_STREAM_URL_STAT_LINK) {
+					if (BG(CurrentLStatFile)) {
+						efree(BG(CurrentLStatFile));
+					}
+					BG(CurrentLStatFile) = estrdup(path);
+					memcpy(&BG(lssb), ssb, sizeof(php_stream_statbuf));
+				} else {
+					if (BG(CurrentStatFile)) {
+						efree(BG(CurrentStatFile));
+					}
+					BG(CurrentStatFile) = estrdup(path);
+					memcpy(&BG(ssb), ssb, sizeof(php_stream_statbuf));
 				}
-				BG(CurrentLStatFile) = estrdup(path);
-				memcpy(&BG(lssb), ssb, sizeof(php_stream_statbuf));
-			} else {
-				if (BG(CurrentStatFile)) {
-					efree(BG(CurrentStatFile));
-				}
-				BG(CurrentStatFile) = estrdup(path);
-				memcpy(&BG(ssb), ssb, sizeof(php_stream_statbuf));
 			}
 		}
 		return ret;