Bugsalert.com
Security News about Viruses, Spyware,
Trojans, Malware, XSS attacks.

Bug 51860 [Open] Include fails with toplevel symlink to /

BugsAlert Home > Bug 51860 [Open] Include fails with toplevel symlink to /
 
 

Reproducible crash (Bug)
Reported by stephan.suerken@...
2010-05-19T16:46:20+02:00
PHP: 5.3.2, OS: , Package Version: 

Description:
------------
Tarball: http://stephan-suerken.de/tmp/php53include.tar.gz

Hi,

with a certain directory setup (symlink pointing to /, see file tree in php53include.tar.gz) plus script call syntax (see scripts "ok" and "fail" scripts in tarball), including a file meekly fails.

I have not completely debugged it, but afaics "php_resolve_path" fails were it should not; I suspect some of the "canonize path" functions wrongly give an error here.

Thanks,

Stephan

Test script:
---------------
Steps to reproduce:

1. Download: http://stephan-suerken.de/tmp/php53include.tar.gz
[as root]
2. cd /
3. tar xfz php53include.tar.gz
4. /phptest/fail


Expected result:
----------------
# manwe(CHROOT:sid-ui): /phptest
# root? ./ok 
/phpinclude/inc123.php: OK, INCLUDED



Actual result:
--------------
# manwe(CHROOT:sid-ui): /phptest
# root? ./fail
PHP Warning:  require(/phplink/phpinclude/inc123.php): failed to open stream: No such file or directory in /phptest/test.php on line 2
PHP Fatal error:  require(): Failed opening required '/phplink/phpinclude/inc123.php' (include_path='.:/usr/share/php:/usr/share/pear') in /phptest/test.php on line 2





Original Source: http://bugs.php.net/51860

Learn more about Bug 51860 [Open] Include fails with toplevel symlink to /
 
Tags: bug 51860 open include fails toplevel symlink

Related Items

      Robert Kaiser: Weekly Status Report, W16/2010

      CVE-2008-3241 (ultrastats)

      Trojan-Downloader.Win32.Small.fzu

      CVE-2009-3852 (ibm_runtimes_for_java_technology)

      The Mozilla Blog: Mozilla Labs Launches Prism 1.0 beta

      The Smart Paranoid's Guide to Using Google

      European Mozilla Community Blog: Mozilla Russia Planet is open!

 

Pixel