From a10aaa35e9d9c3bfff7d10d8812119ee931e24cb Mon Sep 17 00:00:00 2001 From: Pierre Joye Date: Thu, 4 Feb 2010 09:40:38 +0000 Subject: [PATCH] - Fixed a possible open_basedir/safe_mode bypass in session extension --- ext/session/session.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ext/session/session.c b/ext/session/session.c index ea3530dcdb..0ef856c9bf 100644 --- a/ext/session/session.c +++ b/ext/session/session.c @@ -687,8 +687,13 @@ static PHP_INI_MH(OnUpdateSaveDir) /* {{{ */ return FAILURE; } - if ((p = zend_memrchr(new_value, ';', new_value_length))) { + /* we do not use zend_memrchr() since path can contain ; itself */ + if ((p = strchr(new_value, ';'))) { + char *p2; p++; + if ((p2 = strchr(p, ';'))) { + p = p2 + 1; + } } else { p = new_value; } -- 2.50.1