From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 27 Mar 2006 23:42:22 +0000 (+0000)
Subject: MFH: Check 2nd parameter of tempnam() against path components.
X-Git-Tag: php-4.4.3RC1~33
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=779c4394e4de82063af74fe1b04652f70fb0b473;p=php

MFH: Check 2nd parameter of tempnam() against path components.
---

diff --git a/ext/standard/file.c b/ext/standard/file.c
index 5c911df70b..c85fbd8aba 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -552,8 +552,9 @@ PHP_FUNCTION(tempnam)
 	pval **arg1, **arg2;
 	char *d;
 	char *opened_path;
-	char p[64];
+	char *p;
 	FILE *fp;
+	size_t p_len;
 
 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -566,7 +567,11 @@ PHP_FUNCTION(tempnam)
 	}
 
 	d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1));
-	strlcpy(p, Z_STRVAL_PP(arg2), sizeof(p));
+
+	php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len TSRMLS_CC);
+	if (p_len > 64) {
+		p[63] = '\0';
+	}
 
 	if ((fp = php_open_temporary_file(d, p, &opened_path TSRMLS_CC))) {
 		fclose(fp);
@@ -574,6 +579,7 @@ PHP_FUNCTION(tempnam)
 	} else {
 		RETVAL_FALSE;
 	}
+	efree(p);
 	efree(d);
 }
 /* }}} */