fix for bug #14832: basename with 2nd parm corrupts source string

diff --git a/ext/standard/string.c b/ext/standard/string.c
index c7ef00d9f49e8be1b8c15a436ab1d169ad87fe8b..764b394cc417f2651b3c6f1bdef54591e03e581e 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1073,14 +1073,16 @@ PHP_FUNCTION(strtolower)
  */
 PHPAPI char *php_basename(char *s, size_t len, char *suffix, size_t sufflen)
 {
-       char *ret=NULL, *c, *p=NULL, buf='\0';
+       char *ret=NULL, *c, *p=NULL, buf='\0', *p2=NULL, buf2='\0';
        c = s + len - 1;        
 
        /* do suffix removal as the unix command does */
        if(suffix && (len > sufflen)) {
                if(!strncmp(suffix, c-sufflen+1, sufflen)) {
                        c -= sufflen; 
-                       *(c + 1) = '\0';
+                       buf2 = *(c + 1); /* Save overwritten char */
+                       *(c + 1) = '\0'; /* overwrite char */
+                       p2 = c + 1;      /* Save pointer to overwritten char */
                }
        }
 
@@ -1108,6 +1110,7 @@ PHPAPI char *php_basename(char *s, size_t len, char *suffix, size_t sufflen)
                ret = estrdup(s);
        }
        if(buf) *p = buf;
+       if(buf2) *p2 = buf2;
        return (ret);
 }
 /* }}} */