From: Ilia Alshanetsky <iliaa@php.net>
Date: Thu, 28 Feb 2008 00:29:29 +0000 (+0000)
Subject: Fixed security issue detailed in CVE-2008-0599
X-Git-Tag: php-5.2.6RC1~2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9c3f699ed8dbe9f317255855a4201f50df335858;p=php

Fixed security issue detailed in CVE-2008-0599
---

diff --git a/NEWS b/NEWS
index 3305e03bd3..675d9e1664 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2008, PHP 5.2.6
+27 Feb 2008, PHP 5.2.6RC1
+- Fixed security issue detailed in CVE-2008-0599. (Rasmus)
 - Fixed potential memleak in stream filter parameter for zlib filter (Greg)
 - Added Reflection API metadata for the methods of the DOM classes. (Sebastian)
 - Fixed weired behavior in CGI parameter parsing. (Dmitry, Hannes Magnusson)
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index 660df6336e..e9cfe31403 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -1017,7 +1017,7 @@ static void init_request_info(TSRMLS_D)
 						) {
 							/* PATH_TRANSLATED = PATH_TRANSLATED - SCRIPT_NAME + PATH_INFO */
 							int ptlen = strlen(pt) - strlen(env_script_name);
-							int path_translated_len = ptlen + env_path_info ? strlen(env_path_info) : 0;
+							int path_translated_len = ptlen + (env_path_info ? strlen(env_path_info) : 0);
 							char *path_translated = NULL;
 
 							path_translated = (char *) emalloc(path_translated_len + 1);