Fix bug #69923 - Buffer overflow and stack smashing error in phar_fix…

…_filepath
Metabolix · Jul 7, 2015 · 12ff955 · 12ff955
1 parent 00f177a
commit 12ff955
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/ext/phar/phar.c b/ext/phar/phar.c
@@ -2073,16 +2073,18 @@ static int php_check_dots(const char *element, int n) /* {{{ */
  */
 char *phar_fix_filepath(char *path, int *new_len, int use_cwd) /* {{{ */
 {
-	char newpath[MAXPATHLEN];
+	char *newpath;
 	int newpath_len;
 	char *ptr;
 	char *tok;
 	int ptr_length, path_length = *new_len;
 
 	if (PHAR_G(cwd_len) && use_cwd && path_length > 2 && path[0] == '.' && path[1] == '/') {
 		newpath_len = PHAR_G(cwd_len);
+		newpath = emalloc(strlen(path) + newpath_len + 1);
 		memcpy(newpath, PHAR_G(cwd), newpath_len);
 	} else {
+		newpath = emalloc(strlen(path) + 2);
 		newpath[0] = '/';
 		newpath_len = 1;
 	}
@@ -2105,16 +2107,19 @@ char *phar_fix_filepath(char *path, int *new_len, int use_cwd) /* {{{ */
 				if (*tok == '.') {
 					efree(path);
 					*new_len = 1;
+					efree(newpath);
 					return estrndup("/", 1);
 				}
 				break;
 			case 2:
 				if (tok[0] == '.' && tok[1] == '.') {
 					efree(path);
 					*new_len = 1;
+					efree(newpath);
 					return estrndup("/", 1);
 				}
 		}
+		efree(newpath);
 		return path;
 	}
 
@@ -2163,7 +2168,8 @@ char *phar_fix_filepath(char *path, int *new_len, int use_cwd) /* {{{ */
 
 	efree(path);
 	*new_len = newpath_len;
-	return estrndup(newpath, newpath_len);
+	newpath[newpath_len] = '\0';
+	return erealloc(newpath, newpath_len + 1);
 }
 /* }}} */