- add openbase_dir checks in ::open and addFile()

diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c
index 393b5c28ff8fb8d19f674eeaee4cbe874865edba..83af1280d3a08eb9e391c4f4465d4c8724a649f3 100644 (file)
--- a/ext/zip/php_zip.c
+++ b/ext/zip/php_zip.c
@@ -927,6 +927,10 @@ static ZIPARCHIVE_METHOD(open)
                RETURN_FALSE;
        }
 
+       if (OPENBASEDIR_CHECKPATH(filename)) {
+               RETURN_FALSE;
+       }
+
        if(!expand_filepath(filename, resolved_path TSRMLS_CC)) {
                RETURN_FALSE;
        }
@@ -1067,6 +1071,10 @@ static ZIPARCHIVE_METHOD(addFile)
                }
        }
 
+       if (OPENBASEDIR_CHECKPATH(filename)) {
+               RETURN_FALSE;
+       }
+
        if(!expand_filepath(filename, resolved_path TSRMLS_CC)) {
                if (Z_TYPE_PP(filename_zval) == IS_UNICODE) {
                        efree(entry_name);