From 0a830b33fc04161d6e8a6949a158c4706e0e30e0 Mon Sep 17 00:00:00 2001 From: Antony Dovgal Date: Fri, 6 May 2005 16:48:30 +0000 Subject: [PATCH] fix off-by-one in _php_image_output() and prevent such errors in php_do_open_temporary_file() --- ext/gd/gd.c | 2 +- main/php_open_temporary_file.c | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ext/gd/gd.c b/ext/gd/gd.c index dc706d53b0..620490fa95 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -1778,7 +1778,7 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char char buf[4096]; char *path; - tmp = php_open_temporary_file("", "", &path TSRMLS_CC); + tmp = php_open_temporary_file(NULL, NULL, &path TSRMLS_CC); if (tmp == NULL) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open temporary file"); RETURN_FALSE; diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c index b64ddc8dfe..9e602f2104 100644 --- a/main/php_open_temporary_file.c +++ b/main/php_open_temporary_file.c @@ -98,6 +98,7 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, char ** { char *trailing_slash; char *opened_path; + int path_len = 0; int fd = -1; #ifndef HAVE_MKSTEMP int open_flags = O_CREAT | O_TRUNC | O_RDWR @@ -111,11 +112,13 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, char ** return -1; } + path_len = strlen(path); + if (!(opened_path = emalloc(MAXPATHLEN))) { return -1; } - if (IS_SLASH(path[strlen(path)-1])) { + if (!path_len || IS_SLASH(path[path_len - 1])) { trailing_slash = ""; } else { trailing_slash = "/"; -- 2.50.1