From: Ilia Alshanetsky <iliaa@php.net>
Date: Sun, 31 Jan 2010 18:06:29 +0000 (+0000)
Subject: Fixed a possible open_basedir/safe_mode bypass in session extension identified by... 
X-Git-Tag: php-5.2.13RC2~26
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7df1c95ea17f308cd705c323e6f2edeab946d79d;p=php

Fixed a possible open_basedir/safe_mode bypass in session extension identified by Grzegorz Stachowiak.
---

diff --git a/NEWS b/NEWS
index 490571d882..bb1fad7538 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,9 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Feb 2010, PHP 5.2.13
+- Fixed a possible open_basedir/safe_mode bypass in session extension
+  identified by Grzegorz Stachowiak. (Ilia)
+
 
 28 Jan 2010, PHP 5.2.13RC1
 - Updated timezone database to version 2010.2. (Derick)
diff --git a/ext/session/session.c b/ext/session/session.c
index 9f0b917623..59ffd73a3f 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -653,8 +653,13 @@ static PHP_INI_MH(OnUpdateSaveDir) /* {{{ */
 			return FAILURE;
 		}
 
-		if ((p = zend_memrchr(new_value, ';', new_value_length))) {
+		/* we do not use zend_memrchr() since path can contain ; itself */
+		if ((p = strchr(new_value, ';'))) {
+			char *p2;
 			p++;
+			if ((p2 = strchr(p, ';'))) {
+				p = p2 + 1;
+			}
 		} else {
 			p = new_value;
 		}