diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2006-03-27 23:42:22 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2006-03-27 23:42:22 +0000 |
| commit | 779c4394e4de82063af74fe1b04652f70fb0b473 (patch) | |
| tree | 18de029b2f02fdaea99289a23757ee3a722ce2cb | |
| parent | 25a03fe695133ea97ceb76c4275bc328b8ab826e (diff) | |
| download | php-git-779c4394e4de82063af74fe1b04652f70fb0b473.tar.gz | |
MFH: Check 2nd parameter of tempnam() against path components.
| -rw-r--r-- | ext/standard/file.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/ext/standard/file.c b/ext/standard/file.c index 5c911df70b..c85fbd8aba 100644 --- a/ext/standard/file.c +++ b/ext/standard/file.c @@ -552,8 +552,9 @@ PHP_FUNCTION(tempnam) pval **arg1, **arg2; char *d; char *opened_path; - char p[64]; + char *p; FILE *fp; + size_t p_len; if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) { WRONG_PARAM_COUNT; @@ -566,7 +567,11 @@ PHP_FUNCTION(tempnam) } d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1)); - strlcpy(p, Z_STRVAL_PP(arg2), sizeof(p)); + + php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len TSRMLS_CC); + if (p_len > 64) { + p[63] = '\0'; + } if ((fp = php_open_temporary_file(d, p, &opened_path TSRMLS_CC))) { fclose(fp); @@ -574,6 +579,7 @@ PHP_FUNCTION(tempnam) } else { RETVAL_FALSE; } + efree(p); efree(d); } /* }}} */ |