MFH: Fixed bug #38963 (Fixed a possible open_basedir bypass in tempnam()).

diff --git a/NEWS b/NEWS
index 2eb6dd2dac01eaab6e649cbfc31804b55cb09e7e..1559b2037f260082d631345c77c7d03a645c84d7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,7 @@ PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2006, Version 4.4.5
 - Updated PCRE to version 6.7. (Ilia)
+- Fixed bug #38963 (Fixed a possible open_basedir bypass in tempnam()). (Ilia)
 - Fixed bug #38534 (segfault when calling setlocale() in userspace session
   handler). (Tony)
 - Fixed bug #38450 (constructor is not called for classes used in userspace

diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c
index e870db76f1e742372d69f54c2111f958e9a1518e..e4ce52910e0586c89186346a9ccf6c498c3df1f9 100644 (file)
--- a/main/php_open_temporary_file.c
+++ b/main/php_open_temporary_file.c
@@ -207,6 +207,7 @@ PHPAPI const char* php_get_temporary_directory(void)
 PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC)
 {
        int fd;
+       char *temp_dir = php_get_temporary_directory();
 
        if (!pfx) {
                pfx = "tmp.";
@@ -215,11 +216,19 @@ PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened
                *opened_path_p = NULL;
        }
 
+       if (!dir || *dir == '\0') {
+               if (temp_dir && *temp_dir != '\0' && !php_check_open_basedir(temp_dir TSRMLS_CC)) {
+                       return php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC);
+               } else {
+                       return -1;
+               }
+       }
+
        /* Try the directory given as parameter. */
        fd = php_do_open_temporary_file(dir, pfx, opened_path_p TSRMLS_CC);
        if (fd == -1) {
                /* Use default temporary directory. */
-               fd = php_do_open_temporary_file(php_get_temporary_directory(), pfx, opened_path_p TSRMLS_CC);
+               fd = php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC);
        }
        return fd;
 }