From 4ca3df56d356ed8c3b55695ed588783e3f91378c Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 27 Mar 2006 23:40:41 +0000
Subject: [PATCH] Check 2nd parameter of tempnam() against path components.

---
 NEWS                |  1 +
 ext/standard/file.c | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index 6e9932c7d8..1be81d49cf 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Mar 2006, PHP 5.1.3RC2
+- Check 2nd parameter of tempnam() against path components. (Ilia)
 - Fixed Apache2 SAPIs header handler modifying header strings. (Mike)
 - Allowed 'auto_globals_jit' work together with 'register_argc_argv'. (Dmitry)
 - Eliminated run-time constant fetching for TRUE, FALSE and NULL. (Dmitry)
diff --git a/ext/standard/file.c b/ext/standard/file.c
index cd8f666335..12816c75c5 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -773,8 +773,9 @@ PHP_FUNCTION(tempnam)
 	zval **arg1, **arg2;
 	char *d;
 	char *opened_path;
-	char p[64];
+	char *p;
 	int fd;
+	size_t p_len;
 
 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -787,7 +788,11 @@ PHP_FUNCTION(tempnam)
 	}
 	
 	d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1));
-	strlcpy(p, Z_STRVAL_PP(arg2), sizeof(p));
+
+	php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len TSRMLS_CC);
+	if (p_len > 64) {
+		p[63] = '\0';
+	}
 
 	if ((fd = php_open_temporary_fd(d, p, &opened_path TSRMLS_CC)) >= 0) {
 		close(fd);
@@ -795,6 +800,7 @@ PHP_FUNCTION(tempnam)
 	} else {
 		RETVAL_FALSE;
 	}
+	efree(p);
 	efree(d);
 }
 /* }}} */
-- 
2.40.0