diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2007-09-04 12:51:49 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2007-09-04 12:51:49 +0000 |
| commit | 72f910c012a3982d5b77193fbda7b908a95c3607 (patch) | |
| tree | 045084490600ff3f394721e3843b96261d3019df /ext | |
| parent | b78b25a33687f46c0aba75061631eee542464e72 (diff) | |
| download | php-git-72f910c012a3982d5b77193fbda7b908a95c3607.tar.gz | |
Fixed possible buffer overflows inside the fnmatch() and glob() functions
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/standard/dir.c | 5 | ||||
| -rw-r--r-- | ext/standard/file.c | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/ext/standard/dir.c b/ext/standard/dir.c index d78bc615f2..1ad24d77ae 100644 --- a/ext/standard/dir.c +++ b/ext/standard/dir.c @@ -401,6 +401,11 @@ PHP_FUNCTION(glob) return; } + if (pattern_len >= MAXPATHLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Pattern exceeds the maximum allowed length of %d characters", MAXPATHLEN); + RETURN_FALSE; + } + if ((GLOB_AVAILABLE_FLAGS & flags) != flags) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "At least one of the passed flags is invalid or not supported on this platform"); RETURN_FALSE; diff --git a/ext/standard/file.c b/ext/standard/file.c index 04d4dc3434..c54ce62313 100644 --- a/ext/standard/file.c +++ b/ext/standard/file.c @@ -2518,6 +2518,11 @@ PHP_FUNCTION(fnmatch) == FAILURE) return; + if (filename_len >= MAXPATHLEN) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Filename exceeds the maximum allowed length of %d characters", MAXPATHLEN); + RETURN_FALSE; + } + RETURN_BOOL( ! fnmatch( pattern, filename, flags )); } /* }}} */ |