From: Christoph M. Becker <cmbecker69@gmx.de>
Date: Wed, 15 Jul 2020 16:37:27 +0000 (+0200)
Subject: Fix #79806: realpath() erroneously resolves link to link
X-Git-Tag: php-7.3.22RC1~32
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d5b59b4303642adac91df2c93969a72bc0f5fa7d;p=php

Fix #79806: realpath() erroneously resolves link to link

After resolving reparse points, the path still may be a reparse point;
in that case we have to resolve that reparse point as well.
---

diff --git a/NEWS b/NEWS
index 0a6e60d419..ffb7d830cb 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless). (cmb)
   . Fixed bug #77932 (File extensions are case-sensitive). (cmb)
+  . Fixed bug #79806 (realpath() erroneously resolves link to link). (cmb)
 
 ?? ??? ????, PHP 7.3.21
 
diff --git a/Zend/zend_virtual_cwd.c b/Zend/zend_virtual_cwd.c
index 253ed8c420..3b90074683 100644
--- a/Zend/zend_virtual_cwd.c
+++ b/Zend/zend_virtual_cwd.c
@@ -845,6 +845,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		}
 
 #ifdef ZEND_WIN32
+retry_reparse_point:
 		if (save) {
 			pathw = php_win32_ioutil_any_to_w(path);
 			if (!pathw) {
@@ -867,7 +868,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);
 
-retry:
+retry_reparse_tag_cloud:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                                (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -928,7 +929,7 @@ retry:
 					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
 					CloseHandle(hLink);
 					(*ll)--;
-					goto retry;
+					goto retry_reparse_tag_cloud;
 				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
@@ -1075,6 +1076,15 @@ retry:
 			free_alloca(pbuffer, use_heap_large);
 			free(substitutename);
 
+			{
+				DWORD attrs = GetFileAttributesA(path);
+				if (!isVolume && (attrs & FILE_ATTRIBUTE_REPARSE_POINT)) {
+					free_alloca(tmp, use_heap);
+					FREE_PATHW()
+					goto retry_reparse_point;
+				}
+			}
+
 			if(isabsolute == 1) {
 				if (!((j == 3) && (path[1] == ':') && (path[2] == '\\'))) {
 					/* use_realpath is 0 in the call below coz path is absolute*/
diff --git a/ext/standard/tests/file/realpath_basic4.phpt b/ext/standard/tests/file/realpath_basic4.phpt
index d782b6d618..5f18dd9841 100644
--- a/ext/standard/tests/file/realpath_basic4.phpt
+++ b/ext/standard/tests/file/realpath_basic4.phpt
@@ -1,11 +1,5 @@
 --TEST--
 Test realpath() with relative paths
---SKIPIF--
-<?php
-if (substr(PHP_OS, 0, 3) == 'WIN') {
-    die('skip no symlinks on Windows');
-}
-?>
 --FILE--
 <?php
 $file_path = dirname(__FILE__);