Commit fdd3839

committed

Merge branch 'PHP-8.4'

* PHP-8.4: Fix potential OOB read in zend_dirname() on Windows

2 parents 1668a16 + ba7dee5 commit fdd3839Copy full SHA for fdd3839

File tree

-3

lines changed

-3

lines changed

Lines changed: 3 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -2196,7 +2196,7 @@ ZEND_API size_t zend_dirname(char *path, size_t len)`
`2196`	`2196`	`}`
`2197`	`2197`
`2198`	`2198`	`/* Strip trailing slashes */`
`2199`		`- while (end >= path && IS_SLASH_P(end)) {`
	`2199`	`+ while (end >= path && IS_SLASH_P_EX(end, end==path)) {`
`2200`	`2200`	`end--;`
`2201`	`2201`	`}`
`2202`	`2202`	`if (end < path) {`
`@@ -2207,7 +2207,7 @@ ZEND_API size_t zend_dirname(char *path, size_t len)`
`2207`	`2207`	`}`
`2208`	`2208`
`2209`	`2209`	`/* Strip filename */`
`2210`		`- while (end >= path && !IS_SLASH_P(end)) {`
	`2210`	`+ while (end >= path && !IS_SLASH_P_EX(end, end==path)) {`
`2211`	`2211`	`end--;`
`2212`	`2212`	`}`
`2213`	`2213`	`if (end < path) {`
`@@ -2218,7 +2218,7 @@ ZEND_API size_t zend_dirname(char *path, size_t len)`
`2218`	`2218`	`}`
`2219`	`2219`
`2220`	`2220`	`/* Strip slashes which came before the file name */`
`2221`		`- while (end >= path && IS_SLASH_P(end)) {`
	`2221`	`+ while (end >= path && IS_SLASH_P_EX(end, end==path)) {`
`2222`	`2222`	`end--;`
`2223`	`2223`	`}`
`2224`	`2224`	`if (end < path) {`

Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -75,8 +75,11 @@ typedef unsigned short mode_t;`
`75`	`75`	`#define DEFAULT_SLASH '\\'`
`76`	`76`	`#define DEFAULT_DIR_SEPARATOR ';'`
`77`	`77`	`#define IS_SLASH(c) ((c) == '/' \|\| (c) == '\\')`
	`78`	`+// IS_SLASH_P() may read the previous char on Windows, which may be OOB; use IS_SLASH_P_EX() instead`
`78`	`79`	`#define IS_SLASH_P(c) (*(c) == '/' \|\| \`
`79`	`80`	`((c) == '\\' && !IsDBCSLeadByte((c-1))))`
	`81`	`+#define IS_SLASH_P_EX(c, first_byte) (*(c) == '/' \|\| \`
	`82`	`+ ((c) == '\\' && ((first_byte) \|\| !IsDBCSLeadByte((c-1)))))`
`80`	`83`
`81`	`84`	`/* COPY_WHEN_ABSOLUTE is 2 under Win32 because by chance both regular absolute paths`
`82`	`85`	`in the file system and UNC paths need copying of two characters */`
`@@ -110,7 +113,9 @@ typedef unsigned short mode_t;`
`110`	`113`	`#endif`
`111`	`114`
`112`	`115`	`#define IS_SLASH(c) ((c) == '/')`
	`116`	`+// IS_SLASH_P() may read the previous char on Windows, which may be OOB; use IS_SLASH_P_EX() instead`
`113`	`117`	`#define IS_SLASH_P(c) (*(c) == '/')`
	`118`	`+#define IS_SLASH_P_EX(c, first_byte) IS_SLASH_P(c)`
`114`	`119`
`115`	`120`	`#endif`
`116`	`121`

Comments

(0)