Fixed bug #77484 Zend engine crashes when calling realpath in invalid working dir

diff --git a/Zend/zend_virtual_cwd.c b/Zend/zend_virtual_cwd.c
index d26aec91483742608a19db5bbde3d437f18c339b..8a41cfc343de33d7829f784bbb4dc93c99838c08 100644 (file)
--- a/Zend/zend_virtual_cwd.c
+++ b/Zend/zend_virtual_cwd.c
@@ -764,7 +764,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
                if (i == len ||
                        (i + 1 == len && path[i] == '.')) {
                        /* remove double slashes and '.' */
-                       len = i - 1;
+                       len = EXPECTED(i > 0) ? i - 1 : 0;
                        is_dir = 1;
                        continue;
                } else if (i + 2 == len && path[i] == '.' && path[i+1] == '.') {

diff --git a/ext/standard/tests/file/realpath_bug77484.phpt b/ext/standard/tests/file/realpath_bug77484.phpt
new file mode 100644 (file)
index 0000000..37cc5c2
--- /dev/null
+++ b/ext/standard/tests/file/realpath_bug77484.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #77484 Zend engine crashes when calling realpath in invalid working dir
+--SKIPIF--
+<?php
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die("skip can't remove CWD on Windows");
+}
+?>
+--FILE--
+<?php
+
+var_dump(\getcwd());
+
+\mkdir(__DIR__ . "/foo");
+\chdir(__DIR__ . "/foo");
+\rmdir(__DIR__ . "/foo");
+
+// Outputs: / (incorrect)
+var_dump(\getcwd());
+
+// Outputs: false (correct)
+var_dump(\realpath(''));
+
+// Crash
+var_dump(\realpath('.'), \realpath('./'));
+
+?>
+--EXPECTF--
+string(%d) "%s"
+bool(false)
+bool(false)
+string(1) "."
+string(1) "."