# bugs in glob() function

- Thread: https://externals.io/message/21046
- Original archive: https://news-web.php.net/php.internals/21046
- Started by Marcin Obara on 2005-12-05T09:17:52+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #21046 — Marcin Obara — 2005-12-05T09:17:52+00:00

URL: https://externals.io/message/21046#21046

1.
 `glob()` function can cause crash in ZTS mode.
For relative path in ZTS we can find code:
  [...]
  cwd_skip = strlen(cwd)+1;
  snprintf(work_pattern, MAXPATHLEN, "%s%c%s", cwd, DEFAULT_SLASH, pattern);
  [...]
  add_next_index_string(return_value, globbuf.gl_pathv[n]+cwd_skip, 1);
  [...]
If pattern contains something like "./../../../../../../../*" ,
globbuf.gl_pathv[n]  could me shorter than  cwd_skip.
In result we can read from illegal area of memory.

2.
in code we can read:
        /* we assume that any glob pattern will match files from one 
directory only
           so checking the dirname of the first match should be 
sufficient */
But it's not true. `Glob()` can match files from more than one directory.
i.e:  "./*/*" will match files from many directories

About my solution:
- in safe_mode / open_basedir set -- I dont allow use regular expresions 
before last slash in pattern -- so glob will match files only from one 
directory
- pattern is expanded using virtual_file_ex (without using realname of 
course) to eliminate '..' '.' dirs. If pattern 'leaves' current 
directory, will be used as absolute pattern (result will contain full 
names - not relative ones).
- added missing globfree() calls.
- added (missing?) terminating '\0' in line 453

This patch is not so beautiful (my english too -- I'm not native english 
speaker) , but I hope it will help you fix these bugs.

Best regards.
--
Marcin Obara