Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:10449 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 98497 invoked by uid 1010); 14 Jun 2004 17:54:07 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 98426 invoked from network); 14 Jun 2004 17:54:06 -0000 Received: from unknown (HELO asuka.prohost.org) (69.196.31.138) by pb1.pair.com with SMTP; 14 Jun 2004 17:54:06 -0000 Received: (qmail 22480 invoked from network); 14 Jun 2004 17:54:06 -0000 Received: from rei.nerv (HELO dummy.com) (rei@192.168.1.1) by asuka.nerv with SMTP; 14 Jun 2004 17:54:06 -0000 Reply-To: ilia@prohost.org To: internals@lists.php.net Date: Mon, 14 Jun 2004 13:54:10 -0400 User-Agent: KMail/1.6.1 References: In-Reply-To: Organization: Prohost.org MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset="koi8-r" Content-Transfer-Encoding: 7bit Message-ID: <200406141354.10937.ilia@prohost.org> Subject: Re: [PHP-DEV] basename() memory access violation From: ilia@prohost.org (Ilia Alshanetsky) Do you have an example script that can be used to reproduce the supposed memory access violation? Ilia On June 14, 2004 01:51 pm, Alexander Valyalkin wrote: > Here is patch for basename() function, which prevents possible > memory access violation: > > =========cut========= > --- string.c Thu May 13 20:44:32 2004 > +++ string_basename.c Mon Jun 14 20:43:33 2004 > @@ -1079,9 +1079,9 @@ > > > /* strip trailing slashes */ > - while (*c == '/' > + while (c >= s && *c == '/' > #ifdef PHP_WIN32 > - || (*c == '\\' && !IsDBCSLeadByte(*(c-1))) > + || (c > s && *c == '\\' && !IsDBCSLeadByte(*(c-1))) > #endif > ) > c--; > @@ -1092,10 +1092,10 @@ > } > > #ifdef PHP_WIN32 > - if ((c = strrchr(s, '/')) || ((c = strrchr(s, '\\')) && > !IsDBCSLeadByte(*(c-1)))) { > + if ((c = strrchr(s, '/')) || ((c = strrchr(s, '\\')) && c > s && > !IsDBCSLeadByte(*(c-1)))) { > if (*c == '/') { > char *c2 = strrchr(s, '\\'); > - if (c2 && !IsDBCSLeadByte(*(c2-1)) && c2 > c) { > + if (c2 && c2 > s && !IsDBCSLeadByte(*(c2-1)) && c2 > c) { > c = c2; > } > } > =========cut========== > > -- > Using Opera's revolutionary e-mail client: http://www.opera.com/m2/