MFB: Fixed regression in glob() when enforcing safe_mode/open_basedir checks

on paths containing '*'

diff --git a/ext/standard/dir.c b/ext/standard/dir.c
index 275d102bcf0f291775cae14c96f91e1f6913674b..07a3df957a95be0aa19be58b20e71daa698fbbf6 100644 (file)
--- a/ext/standard/dir.c
+++ b/ext/standard/dir.c
@@ -421,6 +421,7 @@ PHP_FUNCTION(glob)
        glob_t globbuf;
        unsigned int n;
        int ret;
+       zend_bool basedir_limit = 0;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z|l", &pppattern, &flags) == FAILURE ||
                php_stream_path_param_encode(pppattern, &pattern, &pattern_len, REPORT_ERRORS, FG(default_context)) == FAILURE) {
@@ -455,18 +456,6 @@ PHP_FUNCTION(glob)
        } 
 #endif
 
-       if (PG(open_basedir) && *PG(open_basedir)) {
-               int pattern_len = strlen(pattern);
-               char *basename = estrndup(pattern, pattern_len);
-               
-               php_dirname(basename, pattern_len);
-               if (php_check_open_basedir(basename TSRMLS_CC)) {
-                       efree(basename);
-                       RETURN_FALSE;
-               }
-               efree(basename);
-       }
-
        memset(&globbuf, 0, sizeof(glob_t));
        globbuf.gl_offs = 0;
        if (0 != (ret = glob(pattern, flags & GLOB_FLAGMASK, NULL, &globbuf))) {
@@ -480,8 +469,7 @@ PHP_FUNCTION(glob)
                           can be used for simple glob() calls without further error
                           checking.
                        */
-                       array_init(return_value);
-                       return;
+                       goto no_results;
                }
 #endif
                RETURN_FALSE;
@@ -489,12 +477,26 @@ PHP_FUNCTION(glob)
 
        /* now catch the FreeBSD style of "no matches" */
        if (!globbuf.gl_pathc || !globbuf.gl_pathv) {
+no_results:
+               if (PG(open_basedir) && *PG(open_basedir)) {
+                       struct stat s;
+
+                       if (0 != VCWD_STAT(pattern, &s) || S_IFDIR != (s.st_mode & S_IFMT)) {
+                               RETURN_FALSE;
+                       }
+               }
                array_init(return_value);
                return;
        }
 
        array_init(return_value);
        for (n = 0; n < globbuf.gl_pathc; n++) {
+               if (PG(open_basedir) && *PG(open_basedir)) {
+                       if (php_check_open_basedir_ex(globbuf.gl_pathv[n], 0 TSRMLS_CC)) {
+                               basedir_limit = 1;
+                               continue;
+                       }
+               }
                /* we need to do this everytime since GLOB_ONLYDIR does not guarantee that
                 * all directories will be filtered. GNU libc documentation states the
                 * following: 
@@ -531,6 +533,11 @@ PHP_FUNCTION(glob)
        }
 
        globfree(&globbuf);
+
+       if (basedir_limit && !zend_hash_num_elements(Z_ARRVAL_P(return_value))) {
+               zval_dtor(return_value);
+               RETURN_FALSE;
+       }
 }
 /* }}} */
 #endif