fix for bug 15516, patch submitted by torben@php.net

diff --git a/ext/odbc/php_odbc.c b/ext/odbc/php_odbc.c
index dddf743ab582e24613a7a48375fb50d789a94520..949a3e08b75853e2b07d2b4f94d4387db93a6aff 100644 (file)
--- a/ext/odbc/php_odbc.c
+++ b/ext/odbc/php_odbc.c
@@ -943,10 +943,21 @@ PHP_FUNCTION(odbc_execute)
                        else
                                ctype = SQL_C_CHAR;
 
-                       if (Z_STRVAL_PP(tmp)[0] == '\'' && 
+                       if (Z_STRLEN_PP(tmp) > 2 &&
+                               Z_STRVAL_PP(tmp)[0] == '\'' &&
                                Z_STRVAL_PP(tmp)[Z_STRLEN_PP(tmp) - 1] == '\'') {
-                               filename = &Z_STRVAL_PP(tmp)[1];
-                               filename[Z_STRLEN_PP(tmp) - 2] = '\0';
+                               filename = estrndup(&Z_STRVAL_PP(tmp)[1], Z_STRLEN_PP(tmp) - 2);
+                               filename[strlen(filename)] = '\0';
+
+                               /* Check for safe mode. */
+                               if (PG(safe_mode) && (!php_checkuid(filename, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
+                                               RETURN_FALSE;
+                                       }
+
+                               /* Check the basedir */
+                               if (php_check_open_basedir(filename TSRMLS_CC)) {
+                                       RETURN_FALSE;
+                               }
 
                 if ((params[i-1].fp = open(filename,O_RDONLY)) == -1) {
                                        php_error(E_WARNING,"Can't open file %s", filename);
@@ -957,9 +968,12 @@ PHP_FUNCTION(odbc_execute)
                                                }
                                        }
                                        efree(params);
+                                       efree(filename);
                                        RETURN_FALSE;
                                }
 
+                               efree(filename);
+
                                params[i-1].vallen = SQL_LEN_DATA_AT_EXEC(0);
 
                                rc = SQLBindParameter(result->stmt, (UWORD)i, SQL_PARAM_INPUT,