fix #36258 (SplFileObject::getPath() may lead to segfault)

diff --git a/NEWS b/NEWS
index 4bfc8ababe8c24c441cf9b477be176f33f5abf90..2a6f4b17510154842a8098ebd53f47a240d787bc 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ PHP                                                                        NEWS
 - Added imap_savebody() that allows message body to be written to a file. (Mike)
 - Fixed imagecolorallocate() and imagecolorallocatelapha() to return FALSE
   on error. (Pierre)
+- Fixed bug #36258 (SplFileObject::getPath() may lead to segfault). (Tony)
 - Fixed bug #36242 (Possible memory corruption in stream_select()). (Tony)
 - Fixed bug #36235 (ocicolumnname returns false before a succesfull fetch). 
   (Tony)

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index 249f42700622d750085cc23b11ba345c1a0fd129..3436452acf766f111d4a7618d18c610054f3c2ec 100755 (executable)
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -340,6 +340,8 @@ static spl_filesystem_object * spl_filesystem_object_create_type(int ht, spl_fil
                spl_filesystem_object_get_file_name(source TSRMLS_CC);
                intern->file_name = estrndup(source->file_name, source->file_name_len);
                intern->file_name_len = source->file_name_len;
+               intern->path = estrndup(source->path, source->path_len);
+               intern->path_len = source->path_len;
                break;
        case SPL_FS_FILE:
                return_value->value.obj = spl_filesystem_object_new_ex(ce ? ce : source->file_class, &intern TSRMLS_CC);