Fix potential buffer overflow.

diff --git a/ext/ftp/ftp.c b/ext/ftp/ftp.c
index 96e2a7f299dae1a10306c6a3d9d68685d7a2b2df..0180c4f5986afb21829691b7d72921077c1aeebd 100644 (file)
--- a/ext/ftp/ftp.c
+++ b/ext/ftp/ftp.c
@@ -538,23 +538,31 @@ ftp_rmdir(ftpbuf_t *ftp, const char *dir)
 /* {{{ ftp_chmod
  */
 int
-ftp_chmod(ftpbuf_t *ftp, const int mode, const char *filename)
+ftp_chmod(ftpbuf_t *ftp, const int mode, const char *filename, const int filename_len)
 {
-       char buffer[1024];
+       char *buffer;
 
-       if (ftp == NULL) {
+       if (ftp == NULL || filename_len <= 0) {
+               return 0;
+       }
+
+       if (!(buffer = emalloc(32 + filename_len + 1))) {
                return 0;
        }
 
        sprintf(buffer, "CHMOD %o %s", mode, filename);
 
        if (!ftp_putcmd(ftp, "SITE", buffer)) {
+               efree(buffer);
                return 0;
        }
 
+       efree(buffer);
+
        if (!ftp_getresp(ftp) || ftp->resp != 200) {
                return 0;
        }
+       
        return 1;
 }
 /* }}} */

diff --git a/ext/ftp/ftp.h b/ext/ftp/ftp.h
index 35bf12bffb49b2b80b96c440e6331f8933e525c2..19233a5d6c624d0524f8d566a53e245778b4aa2c 100644 (file)
--- a/ext/ftp/ftp.h
+++ b/ext/ftp/ftp.h
@@ -136,7 +136,7 @@ char*               ftp_mkdir(ftpbuf_t *ftp, const char *dir);
 int            ftp_rmdir(ftpbuf_t *ftp, const char *dir);
 
 /* Set permissions on a file */
-int            ftp_chmod(ftpbuf_t *ftp, const int mode, const char *filename);
+int            ftp_chmod(ftpbuf_t *ftp, const int mode, const char *filename, const int filename_len);
 
 /* returns a NULL-terminated array of filenames in the given path
  * or NULL on error.  the return array must be freed (but don't

diff --git a/ext/ftp/php_ftp.c b/ext/ftp/php_ftp.c
index b8fc548b1e629e7b914731980affae4640b6aaf8..d43211ad39b921a62eb2248d880060b8759a42c4 100644 (file)
--- a/ext/ftp/php_ftp.c
+++ b/ext/ftp/php_ftp.c
@@ -396,7 +396,7 @@ PHP_FUNCTION(ftp_chmod)
 
        ZEND_FETCH_RESOURCE(ftp, ftpbuf_t*, &z_ftp, -1, le_ftpbuf_name, le_ftpbuf);
 
-       if (!ftp_chmod(ftp, mode, filename)) {
+       if (!ftp_chmod(ftp, mode, filename, filename_len)) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", ftp->inbuf);
                RETURN_FALSE;
        }