fixed shift_jis character corruption including 0x5c as second byte following a slash on uploaded filename.

3 files changed, 21 insertions, 6 deletions

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index cfac113b1f..d333124389 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -1342,6 +1342,15 @@ char *mbstr_strrchr(const char *s, char c TSRMLS_DC){
 	return last;
 }
 
+int mbstr_is_mb_leadbyte(const char *s TSRMLS_DC){
+	unsigned char *p = (unsigned char *)s;
+	if (MBSTRG(current_language) == mbfl_no_language_japanese 
+		&& IS_SJIS1(*p) && IS_SJIS2(*(p+1))){
+		return 1;
+	}
+	return 0;
+}
+
 /* http input processing */
 void mbstr_treat_data(int arg, char *str, zval* destArray TSRMLS_DC)
 {
diff --git a/ext/mbstring/mbstring.h b/ext/mbstring/mbstring.h
index f759f8cfd9..19fe884ac2 100644
--- a/ext/mbstring/mbstring.h
+++ b/ext/mbstring/mbstring.h
@@ -125,6 +125,7 @@ int php_mbregex_name2mbctype(const char *pname);
 #endif
 
 char *mbstr_strrchr(const char *s, char c TSRMLS_DC);
+int mbstr_is_mb_leadbyte(const char *s TSRMLS_DC);
 
 ZEND_BEGIN_MODULE_GLOBALS(mbstring)
 	int language;
diff --git a/main/rfc1867.c b/main/rfc1867.c
index 4feb7f61aa..e420df805f 100644
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -439,7 +439,7 @@ static char *php_ap_getword(char **line, char stop)
 }
 
 
-static char *substring_conf(char *start, int len, char quote)
+static char *substring_conf(char *start, int len, char quote TSRMLS_DC)
 {
 	char *result = emalloc(len + 2);
 	char *resp = result;
@@ -450,6 +450,11 @@ static char *substring_conf(char *start, int len, char quote)
 			*resp++ = start[++i];
 		} else {
 			*resp++ = start[i];
+#if HAVE_MBSTRING
+			if (mbstr_is_mb_leadbyte(start+i) TSRMLS_CC){
+				*resp++ = start[++i];
+			}
+#endif
 		}
 	}
 
@@ -458,7 +463,7 @@ static char *substring_conf(char *start, int len, char quote)
 }
 
 
-static char *php_ap_getword_conf(char **line)
+static char *php_ap_getword_conf(char **line TSRMLS_DC)
 {
 	char *str = *line, *strend, *res, quote;
 
@@ -480,7 +485,7 @@ static char *php_ap_getword_conf(char **line)
 				++strend;
 			}
 		}
-		res = substring_conf(str + 1, strend - str - 1, quote);
+		res = substring_conf(str + 1, strend - str - 1, quote TSRMLS_CC);
 
 		if (*strend == quote) {
 			++strend;
@@ -492,7 +497,7 @@ static char *php_ap_getword_conf(char **line)
 		while (*strend && !isspace(*strend)) {
 			++strend;
 		}
-		res = substring_conf(str, strend - str, 0);
+		res = substring_conf(str, strend - str, 0 TSRMLS_CC);
 	}
 
 	while (*strend && isspace(*strend)) {
@@ -689,12 +694,12 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 						if (param) {
 							efree(param);
 						}
-						param = php_ap_getword_conf(&pair);
+						param = php_ap_getword_conf(&pair TSRMLS_CC);
 					} else if (!strcmp(key, "filename")) {
 						if (filename) {
 							efree(filename);
 						}
-						filename = php_ap_getword_conf(&pair);
+						filename = php_ap_getword_conf(&pair TSRMLS_CC);
 					}
 				}
 				if (key) {