diff options
| author | Anatol Belski <ab@php.net> | 2017-01-24 13:24:11 +0100 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2017-01-24 13:24:11 +0100 |
| commit | 403f3524820a6bfef5873e88f258bf5aafe33ed7 (patch) | |
| tree | 5eda0b51bdaea773561f982c59f4c5ebb1adb5ab | |
| parent | 9aad38038e8bd41b9bf89c00804943509e10fe1a (diff) | |
| download | php-git-403f3524820a6bfef5873e88f258bf5aafe33ed7.tar.gz | |
make length check more robust
| -rw-r--r-- | Zend/zend_virtual_cwd.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/Zend/zend_virtual_cwd.c b/Zend/zend_virtual_cwd.c index 5a0b14901a..0f388dc638 100644 --- a/Zend/zend_virtual_cwd.c +++ b/Zend/zend_virtual_cwd.c @@ -965,7 +965,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i #endif substitutename_len = pbuffer->MountPointReparseBuffer.SubstituteNameLength / sizeof(WCHAR); - if (substitutename_len > MAXPATHLEN) { + if (substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); FREE_PATHW() @@ -974,9 +974,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength); tmpsubstname[substitutename_len] = L'\0'; substitutename = php_win32_cp_conv_w_to_any(tmpsubstname, substitutename_len, &substitutename_len); - if (!substitutename) { + if (!substitutename || substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); + free(substitutename); #if VIRTUAL_CWD_DEBUG free(printname); #endif @@ -999,7 +1000,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i substitutename_len = pbuffer->MountPointReparseBuffer.SubstituteNameLength / sizeof(WCHAR); - if (substitutename_len > MAXPATHLEN) { + if (substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); FREE_PATHW() @@ -1008,9 +1009,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength); tmpsubstname[substitutename_len] = L'\0'; substitutename = php_win32_cp_conv_w_to_any(tmpsubstname, substitutename_len, &substitutename_len); - if (!substitutename) { + if (!substitutename || substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); + free(substitutename); #if VIRTUAL_CWD_DEBUG free(printname); #endif |