diff options
| -rw-r--r-- | Zend/zend_virtual_cwd.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/Zend/zend_virtual_cwd.c b/Zend/zend_virtual_cwd.c index 5a0b14901a..0f388dc638 100644 --- a/Zend/zend_virtual_cwd.c +++ b/Zend/zend_virtual_cwd.c @@ -965,7 +965,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i #endif substitutename_len = pbuffer->MountPointReparseBuffer.SubstituteNameLength / sizeof(WCHAR); - if (substitutename_len > MAXPATHLEN) { + if (substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); FREE_PATHW() @@ -974,9 +974,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength); tmpsubstname[substitutename_len] = L'\0'; substitutename = php_win32_cp_conv_w_to_any(tmpsubstname, substitutename_len, &substitutename_len); - if (!substitutename) { + if (!substitutename || substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); + free(substitutename); #if VIRTUAL_CWD_DEBUG free(printname); #endif @@ -999,7 +1000,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i substitutename_len = pbuffer->MountPointReparseBuffer.SubstituteNameLength / sizeof(WCHAR); - if (substitutename_len > MAXPATHLEN) { + if (substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); FREE_PATHW() @@ -1008,9 +1009,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i memmove(tmpsubstname, reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR), pbuffer->MountPointReparseBuffer.SubstituteNameLength); tmpsubstname[substitutename_len] = L'\0'; substitutename = php_win32_cp_conv_w_to_any(tmpsubstname, substitutename_len, &substitutename_len); - if (!substitutename) { + if (!substitutename || substitutename_len >= MAXPATHLEN) { free_alloca(pbuffer, use_heap_large); free_alloca(tmp, use_heap); + free(substitutename); #if VIRTUAL_CWD_DEBUG free(printname); #endif |