Skip to content

Commit 0e6c065

Browse files
cmb69smalyshev
authored andcommitted
Fix #78862: link() silently truncates after a null byte on Windows
Since link() is supposed to accepts paths (i.e. strings without NUL bytes), we must not accept arbitrary strings.
1 parent a5a1596 commit 0e6c065

File tree

2 files changed

+18
-1
lines changed

2 files changed

+18
-1
lines changed

ext/standard/link_win32.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ PHP_FUNCTION(link)
211211

212212
/*First argument to link function is the target and hence should go to frompath
213213
Second argument to link function is the link itself and hence should go to topath */
214-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss", &frompath, &frompath_len, &topath, &topath_len) == FAILURE) {
214+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "pp", &frompath, &frompath_len, &topath, &topath_len) == FAILURE) {
215215
return;
216216
}
217217

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
Bug #78862 (link() silently truncates after a null byte on Windows)
3+
--FILE--
4+
<?php
5+
file_put_contents(__DIR__ . '/bug78862.target', 'foo');
6+
var_dump(link(__DIR__ . "/bug78862.target\0more", __DIR__ . "/bug78862.link\0more"));
7+
var_dump(file_exists(__DIR__ . '/bug78862.link'));
8+
?>
9+
--EXPECTF--
10+
Warning: link() expects parameter 1 to be a valid path, string given in %s on line %d
11+
NULL
12+
bool(false)
13+
--CLEAN--
14+
<?php
15+
unlink(__DIR__ . '/bug78862.target');
16+
unlink(__DIR__ . '/bug78862.link');
17+
?>

0 commit comments

Comments
 (0)