|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
Patchespatch_php_xmlwriter_c.txt (last revision 2017-12-14 12:19 UTC by yangx92 at hotmail dot com)Pull RequestsHistoryAllCommentsChangesGit/SVN commits
[2017-12-14 15:02 UTC] requinix@php.net
-Status: Open
+Status: Not a bug
[2017-12-14 15:02 UTC] requinix@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Oct 29 04:00:01 2025 UTC |
Description: ------------ There is a coding bug in _xmlwriter_get_valid_file_path function in ext/xmlwriter/php_xmlwriter.c. >>> char file_dirname[MAXPATHLEN]; size_t dir_len; if (!VCWD_REALPATH(source, resolved_path) && !expand_filepath(source, resolved_path)) { xmlFreeURI(uri); return NULL; } memcpy(file_dirname, source, strlen(source)); >>> As code showed above, I think there should be a check for strlen(source) and MAXPATHLEN. If strlen(source) >= MAXPATHLEN, there will be a buffer overflow. Test script: --------------- None Expected result: ---------------- None Actual result: -------------- None