diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-09-01 00:28:39 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-09-01 00:28:39 -0700 |
| commit | 6935058a986034c41d893fa36104b1f68777fd39 (patch) | |
| tree | 5a1b55324a372874eb8ee89337777961950d25af /ext/zip/php_zip.c | |
| parent | fc8eff897bd7fe3fed7f6867d2d6a86117a5278d (diff) | |
| parent | c8f07ad4771620252bf542e09938633bfb837363 (diff) | |
| download | php-git-6935058a986034c41d893fa36104b1f68777fd39.tar.gz | |
Merge branch 'PHP-5.4.45' into PHP-5.5.29
* PHP-5.4.45:
add test
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
Fix bug #70365 - use-after-free vulnerability in unserialize() with SplObjectStorage
Fix bug #70172 - Use After Free Vulnerability in unserialize()
Fix bug #70388 - SOAP serialize_function_call() type confusion
Fixed bug #70350: ZipArchive::extractTo allows for directory traversal when creating directories
Improve fix for #70385
Fix bug #70345 (Multiple vulnerabilities related to PCRE functions)
Fix bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes)
Conflicts:
ext/pcre/php_pcre.c
ext/standard/var_unserializer.c
Diffstat (limited to 'ext/zip/php_zip.c')
| -rw-r--r-- | ext/zip/php_zip.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c index c268059b54..99c293c6d7 100644 --- a/ext/zip/php_zip.c +++ b/ext/zip/php_zip.c @@ -174,7 +174,7 @@ static int php_zip_extract_file(struct zip * za, char *dest, char *file, int fil /* it is a directory only, see #40228 */ if (path_cleaned_len > 1 && IS_SLASH(path_cleaned[path_cleaned_len - 1])) { - len = spprintf(&file_dirname_fullpath, 0, "%s/%s", dest, file); + len = spprintf(&file_dirname_fullpath, 0, "%s/%s", dest, path_cleaned); is_dir_only = 1; } else { memcpy(file_dirname, path_cleaned, path_cleaned_len); @@ -1865,7 +1865,7 @@ static ZIPARCHIVE_METHOD(addFromString) } fail: zip_source_free(zs); - RETURN_FALSE; + RETURN_FALSE; } /* }}} */ |