73 lines
2.5 KiB
Diff
73 lines
2.5 KiB
Diff
From a5a15965da23c8e97657278fc8dfbf1dfb20c016 Mon Sep 17 00:00:00 2001
|
|
From: "Christoph M. Becker" <cmbecker69@gmx.de>
|
|
Date: Mon, 25 Nov 2019 16:56:34 +0100
|
|
Subject: [PATCH] Fix #78863: DirectoryIterator class silently truncates after
|
|
a null byte
|
|
|
|
Since the constructor of DirectoryIterator and friends is supposed to
|
|
accepts paths (i.e. strings without NUL bytes), we must not accept
|
|
arbitrary strings.
|
|
---
|
|
ext/spl/spl_directory.c | 4 ++--
|
|
ext/spl/tests/bug78863.phpt | 31 +++++++++++++++++++++++++++++++
|
|
2 files changed, 33 insertions(+), 2 deletions(-)
|
|
create mode 100644 ext/spl/tests/bug78863.phpt
|
|
|
|
diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
|
|
index 91ea2e0265..56e809b1c7 100644
|
|
--- a/ext/spl/spl_directory.c
|
|
+++ b/ext/spl/spl_directory.c
|
|
@@ -701,10 +701,10 @@ void spl_filesystem_object_construct(INTERNAL_FUNCTION_PARAMETERS, zend_long cto
|
|
|
|
if (SPL_HAS_FLAG(ctor_flags, DIT_CTOR_FLAGS)) {
|
|
flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_FILEINFO;
|
|
- parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &path, &len, &flags);
|
|
+ parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &path, &len, &flags);
|
|
} else {
|
|
flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_SELF;
|
|
- parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s", &path, &len);
|
|
+ parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p", &path, &len);
|
|
}
|
|
if (SPL_HAS_FLAG(ctor_flags, SPL_FILE_DIR_SKIPDOTS)) {
|
|
flags |= SPL_FILE_DIR_SKIPDOTS;
|
|
diff --git a/ext/spl/tests/bug78863.phpt b/ext/spl/tests/bug78863.phpt
|
|
new file mode 100644
|
|
index 0000000000..dc88d98dee
|
|
--- /dev/null
|
|
+++ b/ext/spl/tests/bug78863.phpt
|
|
@@ -0,0 +1,31 @@
|
|
+--TEST--
|
|
+Bug #78863 (DirectoryIterator class silently truncates after a null byte)
|
|
+--FILE--
|
|
+<?php
|
|
+$dir = __DIR__ . '/bug78863';
|
|
+mkdir($dir);
|
|
+touch("$dir/bad");
|
|
+mkdir("$dir/sub");
|
|
+touch("$dir/sub/good");
|
|
+
|
|
+$it = new DirectoryIterator(__DIR__ . "/bug78863\0/sub");
|
|
+foreach ($it as $fileinfo) {
|
|
+ if (!$fileinfo->isDot()) {
|
|
+ var_dump($fileinfo->getFilename());
|
|
+ }
|
|
+}
|
|
+?>
|
|
+--EXPECTF--
|
|
+Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d
|
|
+Stack trace:
|
|
+#0 %s(%d): DirectoryIterator->__construct('%s')
|
|
+#1 {main}
|
|
+ thrown in %s on line %d
|
|
+--CLEAN--
|
|
+<?php
|
|
+$dir = __DIR__ . '/bug78863';
|
|
+unlink("$dir/sub/good");
|
|
+rmdir("$dir/sub");
|
|
+unlink("$dir/bad");
|
|
+rmdir($dir);
|
|
+?>
|
|
--
|
|
2.19.1
|
|
|