Fixed bug #61948 (CURLOPT_COOKIEFILE '' raises open_basedir restriction)

diff --git a/NEWS b/NEWS
index 7bb6cc0719c22a9d283ac8fb2a7f4dedfe5fc19b..e4bc4959631e0a4b7bea88de2bf18fae2e81d06a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,10 @@ PHP                                                                        NEWS
   . Fixed bug #61546 (functions related to current script failed when chdir() 
     in cli sapi). (Laruence, reeze.xia@gmail.com)
 
+- CURL
+  . Fixed bug #61948 (CURLOPT_COOKIEFILE '' raises open_basedir restriction).
+    (Laruence)
+
 - Core:
   . Fixed missing bound check in iptcparse(). (chris at chiappa.net)
   . Fixed bug #61764 ('I' unpacks n as signed if n > 2^31-1 on LP64). (Gustavo)

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 66aafc078e67de20c3d0d6053052b48be8283693..270a7dd807085dbdb55849ee406a6736fc395339 100644 (file)
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -2167,7 +2167,7 @@ string_copy:
 
                        convert_to_string_ex(zvalue);
 
-                       if (php_check_open_basedir(Z_STRVAL_PP(zvalue) TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(zvalue), "rb+", CHECKUID_CHECK_MODE_PARAM))) {
+                       if (!Z_STRLEN_PP(zvalue) || php_check_open_basedir(Z_STRVAL_PP(zvalue) TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(zvalue), "rb+", CHECKUID_CHECK_MODE_PARAM))) {
                                RETVAL_FALSE;
                                return 1;
                        }

diff --git a/ext/curl/tests/bug61948.phpt b/ext/curl/tests/bug61948.phpt
new file mode 100644 (file)
index 0000000..a03fc3b
--- /dev/null
+++ b/ext/curl/tests/bug61948.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #61948 (CURLOPT_COOKIEFILE '' raises open_basedir restriction)
+--SKIPIF--
+<?php if (!extension_loaded("curl")) print "skip"; ?>
+--INI--
+open_basedir="/tmp"
+--FILE--
+<?php
+  $ch = curl_init();
+  var_dump(curl_setopt($ch, CURLOPT_COOKIEFILE, ""));
+  var_dump(curl_setopt($ch, CURLOPT_COOKIEFILE, "/tmp/foo"));
+  var_dump(curl_setopt($ch, CURLOPT_COOKIEFILE, "/xxx/bar"));
+  curl_close($ch);
+?>
+--EXPECTF--
+bool(false)
+bool(true)
+
+Warning: curl_setopt(): open_basedir restriction in effect. File(/xxx/bar) is not within the allowed path(s): (/tmp) in %sbug61948.php on line %d
+bool(false)