Skip to content

Fix potential OOB read in zend_dirname() on Windows #16995

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Fix potential OOB read in zend_dirname() on Windows #16995

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
503c971
Fix potential OOB read in zend_dirname() on Windows
cmb69 Nov 29, 2024
3cc3ba3
Update Zend/zend_virtual_cwd.h
cmb69 Nov 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions Zend/zend_compile.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1997,7 +1997,7 @@ ZEND_API size_t zend_dirname(char *path, size_t len)
}

/* Strip trailing slashes */
while (end >= path && IS_SLASH_P(end)) {
while (end >= path && IS_SLASH_P_EX(end, end == path)) {
end--;
}
if (end < path) {
Expand All @@ -2008,7 +2008,7 @@ ZEND_API size_t zend_dirname(char *path, size_t len)
}

/* Strip filename */
while (end >= path && !IS_SLASH_P(end)) {
while (end >= path && !IS_SLASH_P_EX(end, end == path)) {
end--;
}
if (end < path) {
Expand All @@ -2019,7 +2019,7 @@ ZEND_API size_t zend_dirname(char *path, size_t len)
}

/* Strip slashes which came before the file name */
while (end >= path && IS_SLASH_P(end)) {
while (end >= path && IS_SLASH_P_EX(end, end == path)) {
end--;
}
if (end < path) {
Expand Down
5 changes: 5 additions & 0 deletions Zend/zend_virtual_cwd.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,8 +73,11 @@ typedef unsigned short mode_t;
#define DEFAULT_SLASH '\\'
#define DEFAULT_DIR_SEPARATOR ';'
#define IS_SLASH(c) ((c) == '/' || (c) == '\\')
// IS_SLASH_P() may read the previous char on Windows, which may be OOB; use IS_SLASH_P_EX() instead
#define IS_SLASH_P(c) (*(c) == '/' || \
(*(c) == '\\' && !IsDBCSLeadByte(*(c-1))))
#define IS_SLASH_P_EX(c, first_byte) (*(c) == '/' || \
(*(c) == '\\' && ((first_byte) || !IsDBCSLeadByte(*(c-1)))))

/* COPY_WHEN_ABSOLUTE is 2 under Win32 because by chance both regular absolute paths
in the file system and UNC paths need copying of two characters */
Expand All @@ -98,7 +101,9 @@ typedef unsigned short mode_t;
#endif

#define IS_SLASH(c) ((c) == '/')
// IS_SLASH_P() may read the previous char on Windows, which may be OOB; use IS_SLASH_P_EX() instead
#define IS_SLASH_P(c) (*(c) == '/')
#define IS_SLASH_P_EX(c, first_byte) IS_SLASH_P(c)

#endif

Expand Down
Loading