Skip to content

Fix GH-10992: Improper long path support for relative paths #16687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Fix GH-10992: Improper long path support for relative paths #16687

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1371458
Fix GH-10992: Improper long path support for relative paths
cmb69 Nov 3, 2024
b035a8a
Fix memleak
cmb69 Nov 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions ext/standard/tests/directory/gh10992.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
--TEST--
GH-10992 (Improper long path support for relative paths)
--FILE--
<?php
$dir = str_repeat('b', 250 - strlen(getcwd()));
var_dump(mkdir($dir));
var_dump(rmdir($dir));
$dir = str_repeat('b', 265 - strlen(getcwd()));
var_dump(mkdir($dir));
var_dump(rmdir($dir));
?>
--EXPECT--
bool(true)
bool(true)
bool(true)
bool(true)
29 changes: 25 additions & 4 deletions win32/ioutil.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,7 @@ PW32IO int php_win32_ioutil_close(int fd)

PW32IO int php_win32_ioutil_mkdir_w(const wchar_t *path, mode_t mode)
{/*{{{*/
size_t path_len;
size_t path_len, dir_len = 0;
const wchar_t *my_path;

if (!path) {
Expand All @@ -296,7 +296,16 @@ PW32IO int php_win32_ioutil_mkdir_w(const wchar_t *path, mode_t mode)
PHP_WIN32_IOUTIL_CHECK_PATH_W(path, -1, 0)

path_len = wcslen(path);
if (path_len < _MAX_PATH && path_len >= _MAX_PATH - 12) {
#ifndef ZTS
if (!PHP_WIN32_IOUTIL_IS_ABSOLUTEW(path, path_len) && !PHP_WIN32_IOUTIL_IS_JUNCTION_PATHW(path, path_len) && !PHP_WIN32_IOUTIL_IS_UNC_PATHW(path, path_len)) {
dir_len = GetCurrentDirectoryW(0, NULL);
if (dir_len == 0) {
return -1;
}
}
#endif

if (dir_len + path_len < _MAX_PATH && dir_len + path_len >= _MAX_PATH - 12) {
/* Special case here. From the doc:

"When using an API to create a directory, the specified path cannot be
Expand All @@ -319,7 +328,7 @@ PW32IO int php_win32_ioutil_mkdir_w(const wchar_t *path, mode_t mode)
}

if (!PHP_WIN32_IOUTIL_IS_LONG_PATHW(tmp, path_len)) {
wchar_t *_tmp = (wchar_t *) malloc((path_len + PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW + 1) * sizeof(wchar_t));
wchar_t *_tmp = (wchar_t *) malloc((dir_len + path_len + PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW + 1) * sizeof(wchar_t));
wchar_t *src, *dst;
if (!_tmp) {
SET_ERRNO_FROM_WIN32_CODE(ERROR_NOT_ENOUGH_MEMORY);
Expand All @@ -329,6 +338,18 @@ PW32IO int php_win32_ioutil_mkdir_w(const wchar_t *path, mode_t mode)
memmove(_tmp, PHP_WIN32_IOUTIL_LONG_PATH_PREFIXW, PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW * sizeof(wchar_t));
src = tmp;
dst = _tmp + PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW;
#ifndef ZTS
if (dir_len > 0) {
size_t len = GetCurrentDirectoryW(dir_len, dst);
if (len == 0 || len + 1 != dir_len) {
free(tmp);
free(_tmp);
return -1;
}
dst += len;
*dst++ = PHP_WIN32_IOUTIL_DEFAULT_SLASHW;
}
#endif
while (src < tmp + path_len) {
if (*src == PHP_WIN32_IOUTIL_FW_SLASHW) {
*dst++ = PHP_WIN32_IOUTIL_DEFAULT_SLASHW;
Expand All @@ -337,7 +358,7 @@ PW32IO int php_win32_ioutil_mkdir_w(const wchar_t *path, mode_t mode)
*dst++ = *src++;
}
}
path_len += PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW;
path_len += PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW + dir_len;
_tmp[path_len] = L'\0';
free(tmp);
tmp = _tmp;
Expand Down
34 changes: 28 additions & 6 deletions win32/ioutil.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,18 +180,28 @@ BOOL php_win32_ioutil_init(void);
__forceinline static wchar_t *php_win32_ioutil_conv_any_to_w(const char* in, size_t in_len, size_t *out_len)
{/*{{{*/
wchar_t *mb, *ret;
size_t mb_len;
size_t mb_len, dir_len = 0;

mb = php_win32_cp_conv_any_to_w(in, in_len, &mb_len);
if (!mb) {
return NULL;
}

#ifndef ZTS
if (!PHP_WIN32_IOUTIL_IS_ABSOLUTEW(mb, mb_len) && !PHP_WIN32_IOUTIL_IS_JUNCTION_PATHW(mb, mb_len) && !PHP_WIN32_IOUTIL_IS_UNC_PATHW(mb, mb_len)) {
dir_len = GetCurrentDirectoryW(0, NULL);
if (dir_len == 0) {
free(mb);
return NULL;
}
}
#endif

/* Only prefix with long if it's needed. */
if (mb_len >= _MAX_PATH) {
if (dir_len + mb_len >= _MAX_PATH) {
size_t new_mb_len;

ret = (wchar_t *) malloc((mb_len + PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW + 1) * sizeof(wchar_t));
ret = (wchar_t *) malloc((dir_len + mb_len + PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW + 1) * sizeof(wchar_t));
if (!ret) {
free(mb);
return NULL;
Expand All @@ -204,7 +214,7 @@ __forceinline static wchar_t *php_win32_ioutil_conv_any_to_w(const char* in, siz
}

if (new_mb_len > mb_len) {
wchar_t *tmp = (wchar_t *) realloc(ret, (new_mb_len + 1) * sizeof(wchar_t));
wchar_t *tmp = (wchar_t *) realloc(ret, (dir_len + new_mb_len + 1) * sizeof(wchar_t));
if (!tmp) {
free(ret);
free(mb);
Expand All @@ -220,6 +230,18 @@ __forceinline static wchar_t *php_win32_ioutil_conv_any_to_w(const char* in, siz
} else {
wchar_t *src = mb, *dst = ret + PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW;
memmove(ret, PHP_WIN32_IOUTIL_LONG_PATH_PREFIXW, PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW * sizeof(wchar_t));
#ifndef ZTS
if (dir_len > 0) {
size_t len = GetCurrentDirectoryW(dir_len, dst);
if (len == 0 || len + 1 != dir_len) {
free(ret);
free(mb);
return NULL;
}
dst += len;
*dst++ = PHP_WIN32_IOUTIL_DEFAULT_SLASHW;
}
#endif
while (src < mb + mb_len) {
if (*src == PHP_WIN32_IOUTIL_FW_SLASHW) {
*dst++ = PHP_WIN32_IOUTIL_DEFAULT_SLASHW;
Expand All @@ -228,9 +250,9 @@ __forceinline static wchar_t *php_win32_ioutil_conv_any_to_w(const char* in, siz
*dst++ = *src++;
}
}
ret[mb_len + PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW] = L'\0';
ret[mb_len + PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW + dir_len] = L'\0';

mb_len += PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW;
mb_len += PHP_WIN32_IOUTIL_LONG_PATH_PREFIX_LENW + dir_len;
}

free(mb);
Expand Down