Fix bug #26574 (basename() doesn't work properly with multibyte characters)

diff --git a/ext/standard/ftp_fopen_wrapper.c b/ext/standard/ftp_fopen_wrapper.c
index 6d4014fdd902f165f7ffa545d47426eedde1c58b..52a4e4e289a2afcb9b73dadb0fdb64569703411e 100644 (file)
--- a/ext/standard/ftp_fopen_wrapper.c
+++ b/ext/standard/ftp_fopen_wrapper.c
@@ -562,7 +562,7 @@ static size_t php_ftp_dirstream_read(php_stream *stream, char *buf, size_t count
        php_stream *innerstream = (php_stream *)stream->abstract;
        size_t tmp_len;
        char *basename;
-       int basename_len;
+       size_t basename_len;
 
        if (count != sizeof(php_stream_dirent)) {
                return 0;
@@ -586,8 +586,9 @@ static size_t php_ftp_dirstream_read(php_stream *stream, char *buf, size_t count
                return 0;
        }
 
-       memcpy(ent->d_name, basename, MIN((int)sizeof(ent->d_name), basename_len)-1);
-       ent->d_name[sizeof(ent->d_name)-1] = '\0';
+       tmp_len = MIN(sizeof(ent->d_name), basename_len) - 1;
+       memcpy(ent->d_name, basename, tmp_len);
+       ent->d_name[tmp_len] = '\0';
        efree(basename);
 
        return sizeof(php_stream_dirent);

diff --git a/ext/standard/php_string.h b/ext/standard/php_string.h
index a7882dba96b449477af1a026d5b95540ad13e823..fea95e53cb81fa6974218eabaf0ccc25db450c93 100644 (file)
--- a/ext/standard/php_string.h
+++ b/ext/standard/php_string.h
@@ -122,7 +122,7 @@ PHPAPI char *php_addslashes(char *str, int length, int *new_length, int freeit T
 PHPAPI char *php_addcslashes(char *str, int length, int *new_length, int freeit, char *what, int wlength TSRMLS_DC);
 PHPAPI void php_stripslashes(char *str, int *len TSRMLS_DC);
 PHPAPI void php_stripcslashes(char *str, int *len);
-PHPAPI void php_basename(char *str, size_t  len , char *suffix, size_t sufflen, char **p_ret, int *p_len);
+PHPAPI void php_basename(char *str, size_t  len , char *suffix, size_t sufflen, char **p_ret, size_t *p_len);
 PHPAPI size_t php_dirname(char *str, size_t len);
 PHPAPI char *php_stristr(unsigned char *s, unsigned char *t, size_t s_len, size_t t_len);
 PHPAPI char *php_str_to_str_ex(char *haystack, int length, char *needle,

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 23e505ba236d6d08aa47b05f40e81a1bf14d1985..347bf0769793a4f5b369f8b4c3c65047e0650901 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1068,56 +1068,69 @@ PHP_FUNCTION(strtolower)
 
 /* {{{ php_basename
  */
-PHPAPI void php_basename(char *s, size_t len, char *suffix, size_t sufflen, char **p_ret, int *p_len)
+PHPAPI void php_basename(char *s, size_t len, char *suffix, size_t sufflen, char **p_ret, size_t *p_len)
 {
-       char *ret=NULL, *c;
-       c = s + len - 1;        
-
-       /* strip trailing slashes */
-       while (*c == '/'
+       char *ret = NULL, *c, *comp, *cend;
+       size_t inc_len, cnt;
+       int state;
+
+       c = comp = cend = s;
+       cnt = len;
+       state = 0;
+       while (cnt > 0) {
+               inc_len = (*c == '\0' ? 1: php_mblen(c, cnt));
+
+               switch (inc_len) {
+                       case -2:
+                       case -1:
+                               inc_len = 1;
+                               php_mblen(NULL, 0);
+                               break;
+                       case 0:
+                               goto quit_loop;
+                       case 1:
 #ifdef PHP_WIN32
-                  || (*c == '\\' && !IsDBCSLeadByte(*(c-1)))
+                               if (*c == '/' || *c == '\\') {
+#else
+                               if (*c == '/') {
 #endif
-       ) {
-               c--;
-               len--;
+                                       if (state == 1) {
+                                               state = 0;
+                                               cend = c;
+                                       }
+                               } else {
+                                       if (state == 0) {
+                                               comp = c;
+                                               state = 1;
+                                       }
+                               }
+                       default:
+                               break;
+               }
+               c += inc_len;
+               cnt -= inc_len;
        }
 
-       /* do suffix removal as the unix command does */
-       if (suffix && (len > sufflen)) {
-               if (!memcmp(suffix, c-sufflen+1, sufflen)) {
-                       if( (*(c-sufflen) != '/')
-#ifdef PHP_WIN32
-                  && ( *(c-sufflen) != '\\' || IsDBCSLeadByte(*(c-sufflen-1)))
-#endif                 
-                               ) {
-                               c -= sufflen;
-                               len -= sufflen;
-                       }
-               }
+quit_loop:
+       if (state == 1) {
+               cend = c;
        }
-               
-       while(c>=s) {
-               if(*c == '/'
-#ifdef PHP_WIN32
-                  || ( *c == '\\' && !IsDBCSLeadByte(*(c-1)))
-#endif                 
-                  ) {
-                       c++;
-                       break;
-               }
-               c--;
+       if (suffix != NULL && sufflen < (cend - comp) &&
+                       memcmp(cend - sufflen, suffix, sufflen) == 0) {
+               cend -= sufflen;
        }
 
-       if (c<s) c=s;
-
-       len -= (c-s);
-       ret = emalloc(len+1);
-       memcpy(ret, c, len);
+       len = cend - comp;
+       ret = emalloc(len + 1);
+       memcpy(ret, comp, len);
        ret[len] = '\0';
 
-       if(p_ret) *p_ret = ret;
-       if(p_len) *p_len = len;
+       if (p_ret) {
+               *p_ret = ret;
+       }
+       if (p_len) {
+               *p_len = len;
+       }
 }
 /* }}} */
 
@@ -1126,14 +1139,15 @@ PHPAPI void php_basename(char *s, size_t len, char *suffix, size_t sufflen, char
 PHP_FUNCTION(basename)
 {
        char *string, *suffix = NULL, *ret;
-       int   string_len, suffix_len = 0, ret_len;
+       int   string_len, suffix_len = 0;
+       size_t ret_len;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|s", &string, &string_len, &suffix, &suffix_len) == FAILURE) {
                return;
        }
 
-       php_basename(string, string_len, suffix, suffix_len, &ret, &ret_len);   
-       RETURN_STRINGL(ret, ret_len, 0);
+       php_basename(string, string_len, suffix, suffix_len, &ret, &ret_len);
+       RETURN_STRINGL(ret, (int)ret_len, 0);
 }
 /* }}} */
 
@@ -1230,7 +1244,8 @@ PHP_FUNCTION(pathinfo)
 {
        zval *tmp;
        char *path, *ret = NULL;
-       int path_len, ret_len;
+       int path_len;
+       size_t ret_len;
        long opt = PHP_PATHINFO_ALL;
 
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &path, &path_len, &opt) == FAILURE) {