MFB

diff --git a/ext/xmlreader/php_xmlreader.c b/ext/xmlreader/php_xmlreader.c
index 8b8f3b847a7884da601c094fd99c7c3586285ef7..c41429c5975d3e0bd4492015ceda4c791daa07d2 100644 (file)
--- a/ext/xmlreader/php_xmlreader.c
+++ b/ext/xmlreader/php_xmlreader.c
@@ -259,9 +259,9 @@ char *_xmlreader_get_valid_file_path(char *source, char *resolved_path, int reso
        file_dest = source;
 
        if ((uri->scheme == NULL || isFileUri)) {
-               /* XXX possible buffer overflow if VCWD_REALPATH does not know size of resolved_path */
-               if (! VCWD_REALPATH(source, resolved_path)) {
-                       expand_filepath(source, resolved_path TSRMLS_CC);
+               if (!VCWD_REALPATH(source, resolved_path) && !expand_filepath(source, resolved_path TSRMLS_CC)) {
+                       xmlFreeURI(uri);
+                       return NULL;
                }
                file_dest = resolved_path;
        }

diff --git a/ext/xmlwriter/php_xmlwriter.c b/ext/xmlwriter/php_xmlwriter.c
index 99d84cb1a4a157754ab13b41efaf584fe1921784..e45c0a8a39280904508d437acb3b58cb4210f0c9 100644 (file)
--- a/ext/xmlwriter/php_xmlwriter.c
+++ b/ext/xmlwriter/php_xmlwriter.c
@@ -276,9 +276,9 @@ char *_xmlwriter_get_valid_file_path(char *source, char *resolved_path, int reso
        file_dest = source;
 
        if ((uri->scheme == NULL || isFileUri)) {
-               /* XXX possible buffer overflow if VCWD_REALPATH does not know size of resolved_path */
-               if (! VCWD_REALPATH(source, resolved_path)) {
-                       expand_filepath(source, resolved_path TSRMLS_CC);
+               if (!VCWD_REALPATH(source, resolved_path) && !expand_filepath(source, resolved_path TSRMLS_CC)) {
+                       xmlFreeURI(uri);
+                       return NULL;
                }
                file_dest = resolved_path;
        }