From 5e2ea00b1539d6003548f7698ece1f737c14fb51 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Thu, 6 Feb 2020 14:59:55 +0100
Subject: [PATCH] Fix #66322: COMPersistHelper::SaveToFile can save to wrong
 location

Saving under the given `filename` may also work, but since
`::LoadFromFile` uses the `fullpath` we follow suit.
---
 NEWS                               |  4 ++++
 ext/com_dotnet/com_persist.c       |  2 +-
 ext/com_dotnet/tests/bug66322.phpt | 24 ++++++++++++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 ext/com_dotnet/tests/bug66322.phpt

diff --git a/NEWS b/NEWS
index 08d33690a9..2c810370eb 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.16
 
+- COM:
+  . Fixed bug #66322 (COMPersistHelper::SaveToFile can save to wrong location).
+    (cmb)
+
 - PCRE:
   . Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback
     and unicode). (Nikita)
diff --git a/ext/com_dotnet/com_persist.c b/ext/com_dotnet/com_persist.c
index c782e6695c..0fee0efd43 100644
--- a/ext/com_dotnet/com_persist.c
+++ b/ext/com_dotnet/com_persist.c
@@ -398,7 +398,7 @@ CPH_METHOD(SaveToFile)
 				RETURN_FALSE;
 			}
 
-			olefilename = php_com_string_to_olestring(filename, strlen(fullpath), helper->codepage);
+			olefilename = php_com_string_to_olestring(fullpath, strlen(fullpath), helper->codepage);
 			efree(fullpath);
 		}
 		res = IPersistFile_Save(helper->ipf, olefilename, remember);
diff --git a/ext/com_dotnet/tests/bug66322.phpt b/ext/com_dotnet/tests/bug66322.phpt
new file mode 100644
index 0000000000..de37e4fa75
--- /dev/null
+++ b/ext/com_dotnet/tests/bug66322.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #66322 (COMPersistHelper::SaveToFile can save to wrong location)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+try {
+    new COM('Word.Application');
+} catch (com_exception $ex) {
+    die('skip MS Word not available');
+}
+if (getenv("SKIP_SLOW_TESTS")) die('skip slow test');
+?>
+--FILE--
+<?php
+$w = new COM('Word.Application');
+$doc = $w->Documents->Add();
+$ph = new COMPersistHelper($doc);
+$filename = __DIR__ . '\\..\\' . basename(__DIR__) . '\\66322.docx';
+$ph->SaveToFile($filename);
+var_dump(file_exists($filename));
+$w->Quit();
+?>
+--EXPECT--
+bool(true)
-- 
2.40.0