Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
  Fix #76359: open_basedir bypass through adding ".."

Author: cmb69

NEWS

@@ -6,6 +6,7 @@ PHP                                                                        NEWS
   . Fixed bug #81076 (incorrect debug info on Closures with implicit binds).
     (krakjoe)
   . Fixed bug #81068 (Double free in realpath_cache_clean()). (Dimitry Andric)
+  . Fixed bug #76359 (open_basedir bypass through adding ".."). (cmb)
 
 - Opcache:
   . Fixed bug #80968 (JIT segfault with return from required file). (Dmitry)

main/fopen_wrappers.c

@@ -101,6 +101,11 @@ PHPAPI ZEND_INI_MH(OnUpdateBaseDir)
 			*end = '\0';
 			end++;
 		}
+		if (ptr[0] == '.' && ptr[1] == '.' && (ptr[2] == '\0' || IS_SLASH(ptr[2]))) {
+			/* Don't allow paths with a leading .. path component to be set at runtime */
+			efree(pathbuf);
+			return FAILURE;
+		}
 		if (php_check_open_basedir_ex(ptr, 0) != 0) {
 			/* At least one portion of this open_basedir is less restrictive than the prior one, FAIL */
 			efree(pathbuf);

tests/security/bug76359.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #76359 (open_basedir bypass through adding "..")
+--FILE--
+<?php
+ini_set('open_basedir', __DIR__);
+mkdir(__DIR__ . "/bug76359");
+chdir(__DIR__ . "/bug76359");
+var_dump(ini_set('open_basedir', ini_get('open_basedir') . PATH_SEPARATOR . ".."));
+chdir("..");
+chdir("..");
+?>
+--EXPECTF--
+bool(false)
+
+Warning: chdir(): open_basedir restriction in effect. File(..) is not within the allowed path(s): (%s) in %s on line %d
+--CLEAN--
+<?php
+@rmdir(__DIR__ . "/bug76359");
+?>