From: Hartmut Holzgraefe <hholzgra@php.net>
Date: Thu, 3 Jan 2002 20:20:35 +0000 (+0000)
Subject: fix for bug #14832: basename with 2nd parm corrupts source string
X-Git-Tag: PRE_ISSET_PATCH~318
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c9bc54abc37ed4f0082f802a59846e277bd11971;p=php

fix for bug #14832: basename with 2nd parm corrupts source string
---

diff --git a/ext/standard/string.c b/ext/standard/string.c
index c7ef00d9f4..764b394cc4 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1073,14 +1073,16 @@ PHP_FUNCTION(strtolower)
  */
 PHPAPI char *php_basename(char *s, size_t len, char *suffix, size_t sufflen)
 {
-	char *ret=NULL, *c, *p=NULL, buf='\0';
+	char *ret=NULL, *c, *p=NULL, buf='\0', *p2=NULL, buf2='\0';
 	c = s + len - 1;	
 
 	/* do suffix removal as the unix command does */
 	if(suffix && (len > sufflen)) {
 		if(!strncmp(suffix, c-sufflen+1, sufflen)) {
 			c -= sufflen; 
-			*(c + 1) = '\0';
+			buf2 = *(c + 1); /* Save overwritten char */
+			*(c + 1) = '\0'; /* overwrite char */
+			p2 = c + 1;      /* Save pointer to overwritten char */
 		}
 	}
 
@@ -1108,6 +1110,7 @@ PHPAPI char *php_basename(char *s, size_t len, char *suffix, size_t sufflen)
 		ret = estrdup(s);
 	}
 	if(buf) *p = buf;
+	if(buf2) *p2 = buf2;
 	return (ret);
 }
 /* }}} */