Added missing validation checks around expand_filepath()

diff --git a/ext/com_dotnet/com_persist.c b/ext/com_dotnet/com_persist.c
index 8408d619d92348f6c84807b2ccec68a3bb9d75f3..8738938f1fac11681c958ce4cdc6bb21a6c0ebd6 100755 (executable)
--- a/ext/com_dotnet/com_persist.c
+++ b/ext/com_dotnet/com_persist.c
@@ -390,15 +390,16 @@ CPH_METHOD(SaveToFile)
 
                if (filename) {
                        fullpath = expand_filepath(filename, NULL TSRMLS_CC);
-       
-                       if (PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
+                       if (!fullpath) {
                                RETURN_FALSE;
                        }
-
-                       if (php_check_open_basedir(fullpath TSRMLS_CC)) {
+       
+                       if ((PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || 
+                                       php_check_open_basedir(fullpath TSRMLS_CC)) {
+                               efree(fullpath);
                                RETURN_FALSE;
                        }
-                       
+
                        olefilename = php_com_string_to_olestring(filename, strlen(fullpath), helper->codepage TSRMLS_CC);
                        efree(fullpath);
                }
@@ -452,13 +453,13 @@ CPH_METHOD(LoadFromFile)
                        return;
                }
 
-               fullpath = expand_filepath(filename, NULL TSRMLS_CC);
-
-               if (PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
+               if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) {
                        RETURN_FALSE;
                }
 
-               if (php_check_open_basedir(fullpath TSRMLS_CC)) {
+               if ((PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) ||
+                               php_check_open_basedir(fullpath TSRMLS_CC)) {
+                       efree(fullpath);
                        RETURN_FALSE;
                }
 

diff --git a/ext/sqlite/pdo_sqlite2.c b/ext/sqlite/pdo_sqlite2.c
index 7788b3f8b3d3789ef48fc83c992cd40ebd02dc15..0df676fec4904e50ea2c3dee50d7d77aed6b196b 100644 (file)
--- a/ext/sqlite/pdo_sqlite2.c
+++ b/ext/sqlite/pdo_sqlite2.c
@@ -518,6 +518,10 @@ static char *make_filename_safe(const char *filename TSRMLS_DC)
        if (strncmp(filename, ":memory:", sizeof(":memory:")-1)) {
                char *fullpath = expand_filepath(filename, NULL TSRMLS_CC);
 
+               if (!fullpath) {
+                       return NULL;
+               }
+
                if (PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                        efree(fullpath);
                        return NULL;

diff --git a/ext/sqlite/sqlite.c b/ext/sqlite/sqlite.c
index c499fa530cddfadb138a5ef55cbc2d9638f3608d..b7a9483342b3d1a88f23c2e71d1f1e998dd72244 100644 (file)
--- a/ext/sqlite/sqlite.c
+++ b/ext/sqlite/sqlite.c
@@ -1237,13 +1237,13 @@ PHP_FUNCTION(sqlite_popen)
 
        if (strncmp(filename, ":memory:", sizeof(":memory:") - 1)) {
                /* resolve the fully-qualified path name to use as the hash key */
-               fullpath = expand_filepath(filename, NULL TSRMLS_CC);
-
-               if (PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
+               if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) {
                        RETURN_FALSE;
                }
 
-               if (php_check_open_basedir(fullpath TSRMLS_CC)) {
+               if ((PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || 
+                               php_check_open_basedir(fullpath TSRMLS_CC)) {
+                       efree(fullpath);
                        RETURN_FALSE;
                }
        } else {
@@ -1313,11 +1313,8 @@ PHP_FUNCTION(sqlite_open)
 
        if (strncmp(filename, ":memory:", sizeof(":memory:") - 1)) {
                /* resolve the fully-qualified path name to use as the hash key */
-               fullpath = expand_filepath(filename, NULL TSRMLS_CC);
-
-               if (PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
+               if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) {
                        php_std_error_handling();
-                       efree(fullpath);
                        if (object) {
                                RETURN_NULL();
                        } else {
@@ -1325,7 +1322,8 @@ PHP_FUNCTION(sqlite_open)
                        }
                }
 
-               if (php_check_open_basedir(fullpath TSRMLS_CC)) {
+               if ((PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) ||
+                               php_check_open_basedir(fullpath TSRMLS_CC)) {
                        php_std_error_handling();
                        efree(fullpath);
                        if (object) {
@@ -1334,7 +1332,6 @@ PHP_FUNCTION(sqlite_open)
                                RETURN_FALSE;
                        }
                }
-
        }
 
        php_sqlite_open(fullpath ? fullpath : filename, (int)mode, NULL, return_value, errmsg, object TSRMLS_CC);
@@ -1368,15 +1365,13 @@ PHP_FUNCTION(sqlite_factory)
 
        if (strncmp(filename, ":memory:", sizeof(":memory:") - 1)) {
                /* resolve the fully-qualified path name to use as the hash key */
-               fullpath = expand_filepath(filename, NULL TSRMLS_CC);
-
-               if (PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
-                       efree(fullpath);
+               if (!(fullpath = expand_filepath(filename, NULL TSRMLS_CC))) {
                        php_std_error_handling();
                        RETURN_NULL();
                }
 
-               if (php_check_open_basedir(fullpath TSRMLS_CC)) {
+               if ((PG(safe_mode) && (!php_checkuid(fullpath, NULL, CHECKUID_CHECK_FILE_AND_DIR))) ||
+                               php_check_open_basedir(fullpath TSRMLS_CC)) {
                        efree(fullpath);
                        php_std_error_handling();
                        RETURN_NULL();