Fixed a possible open_basedir/safe_mode bypass in session extension identified by...

diff --git a/NEWS b/NEWS
index b03bb05097be33e208b51b06f73c1a0e645f0bbc..7f2d0ce72459b663adf1a4475dceac74fae119a0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Upgraded bundled sqlite to version 3.6.22. (Ilia)
 - Upgraded bundled libmagic to version 5.03. (Mikko)
 
+- Fixed a possible open_basedir/safe_mode bypass in session extension
+  identified by Grzegorz Stachowiak. (Ilia)
 - Improved LCG entropy. (Rasmus, Samy Kamkar)
 
 - Added libpng 1.4.0 support. (Pierre)

diff --git a/ext/session/session.c b/ext/session/session.c
index ea3530dcdbd0b6e509cc44678607ac44f5885116..0ef856c9bfdaed42e5fe7d18d49391e2c408be77 100644 (file)
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -687,8 +687,13 @@ static PHP_INI_MH(OnUpdateSaveDir) /* {{{ */
                        return FAILURE;
                }
 
-               if ((p = zend_memrchr(new_value, ';', new_value_length))) {
+               /* we do not use zend_memrchr() since path can contain ; itself */
+               if ((p = strchr(new_value, ';'))) {
+                       char *p2;
                        p++;
+                       if ((p2 = strchr(p, ';'))) {
+                               p = p2 + 1;
+                       }
                } else {
                        p = new_value;
                }