diff options
Diffstat (limited to 'ext/phar/phar_object.c')
| -rw-r--r-- | ext/phar/phar_object.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c index 24eaa73bb1..faa5ff26d1 100644 --- a/ext/phar/phar_object.c +++ b/ext/phar/phar_object.c @@ -3635,14 +3635,18 @@ PHP_METHOD(Phar, offsetGet) */ static void phar_add_file(phar_archive_data **pphar, char *filename, int filename_len, char *cont_str, size_t cont_len, zval *zresource) { + int start_pos=0; char *error; size_t contents_len; phar_entry_data *data; php_stream *contents_file; - if (filename_len >= (int)sizeof(".phar")-1 && !memcmp(filename, ".phar", sizeof(".phar")-1) && (filename[5] == '/' || filename[5] == '\\' || filename[5] == '\0')) { - zend_throw_exception_ex(spl_ce_BadMethodCallException, 0, "Cannot create any files in magic \".phar\" directory"); - return; + if (filename_len >= (int)sizeof(".phar")-1) { + start_pos = ('/' == filename[0] ? 1 : 0); /* account for any leading slash: multiple-leads handled elsewhere */ + if (!memcmp(&filename[start_pos], ".phar", sizeof(".phar")-1) && (filename[start_pos+5] == '/' || filename[start_pos+5] == '\\' || filename[start_pos+5] == '\0')) { + zend_throw_exception_ex(spl_ce_BadMethodCallException, 0, "Cannot create any files in magic \".phar\" directory"); + return; + } } if (!(data = phar_get_or_create_entry_data((*pphar)->fname, (*pphar)->fname_len, filename, filename_len, "w+b", 0, &error, 1))) { |