Fix #65069: GlobIterator incorrect handling of open_basedir check

Author: bukka

ext/spl/tests/bug65069.phpt

@@ -0,0 +1,65 @@
+--TEST--
+Bug #65069: GlobIterator fails to access files inside an open_basedir restricted dir
+--FILE--
+<?php
+$file_path = dirname(__FILE__);
+// temp dirname used here
+$dirname = "$file_path/bug65069";
+// temp dir created
+mkdir($dirname);
+
+ini_set('open_basedir', $dirname);
+
+// temp files created
+$fp = fopen("$dirname/wonder12345", "w");
+fclose($fp);
+$fp = fopen("$dirname/wonder.txt", "w");
+fclose($fp);
+$fp = fopen("$dirname/file.text", "w");
+fclose($fp);
+
+$spl_glob_it = new \GlobIterator("$dirname/*.txt");
+foreach ($spl_glob_it as $file_info) {
+    echo $file_info->getFilename() . "\n";
+}
+
+$spl_glob_it = new \GlobIterator(dirname(dirname($dirname)) . "/*/*/*");
+foreach ($spl_glob_it as $file_info) {
+    echo $file_info->getFilename() . "\n";
+}
+
+$spl_glob_empty = new \GlobIterator("$dirname/*.php");
+var_dump($spl_glob_empty->count());
+
+
+var_dump(ini_get('open_basedir'));
+
+// top directory
+$spl_glob_it = new \GlobIterator(dirname(dirname($dirname)));
+foreach ($spl_glob_it as $file_info) {
+    echo $file_info->getFilename() . "\n";
+}
+
+// not existing file
+var_dump(iterator_to_array(new \GlobIterator("$file_path/bug65069-this-will-never-exists")));
+
+
+?>
+--CLEAN--
+<?php
+$file_path = dirname(__FILE__);
+$dirname = "$file_path/bug65069";
+unlink("$dirname/wonder12345");
+unlink("$dirname/wonder.txt");
+unlink("$dirname/file.text");
+rmdir($dirname);
+?>
+--EXPECT--
+wonder.txt
+file.text
+wonder.txt
+wonder12345
+int(0)
+spl
+array(0) {
+}

main/streams/glob_wrapper.c

@@ -41,6 +41,8 @@ typedef struct {
 	size_t   path_len;
 	char     *pattern;
 	size_t   pattern_len;
+	size_t   *open_basedir_indexmap;
+	size_t   open_basedir_indexmap_size;
 } glob_s_t;
 
 PHPAPI char* _php_glob_stream_get_path(php_stream *stream, size_t *plen STREAMS_DC) /* {{{ */
@@ -79,6 +81,9 @@ PHPAPI char* _php_glob_stream_get_pattern(php_stream *stream, size_t *plen STREA
 }
 /* }}} */
 
+#define _php_glob_stream_get_result_count(pglob) \
+	pglob->open_basedir_indexmap ? (int) pglob->open_basedir_indexmap_size : pglob->glob.gl_pathc
+
 PHPAPI int _php_glob_stream_get_count(php_stream *stream, int *pflags STREAMS_DC) /* {{{ */
 {
 	glob_s_t *pglob = (glob_s_t *)stream->abstract;
@@ -87,7 +92,7 @@ PHPAPI int _php_glob_stream_get_count(php_stream *stream, int *pflags STREAMS_DC
 		if (pflags) {
 			*pflags = pglob->flags;
 		}
-		return pglob->glob.gl_pathc;
+		return _php_glob_stream_get_result_count(pglob);
 	} else {
 		if (pflags) {
 			*pflags = 0;
@@ -130,15 +135,20 @@ static ssize_t php_glob_stream_read(php_stream *stream, char *buf, size_t count)
 	glob_s_t *pglob = (glob_s_t *)stream->abstract;
 	php_stream_dirent *ent = (php_stream_dirent*)buf;
 	const char *path;
+	int glob_result_count;
+	size_t index;
 
 	/* avoid problems if someone mis-uses the stream */
 	if (count == sizeof(php_stream_dirent) && pglob) {
-		if (pglob->index < (size_t)pglob->glob.gl_pathc) {
-			php_glob_stream_path_split(pglob, pglob->glob.gl_pathv[pglob->index++], pglob->flags & GLOB_APPEND, &path);
+		glob_result_count = _php_glob_stream_get_result_count(pglob);
+		if (pglob->index < (size_t) glob_result_count) {
+			index = pglob->open_basedir_indexmap ? pglob->open_basedir_indexmap[pglob->index] : pglob->index;
+			php_glob_stream_path_split(pglob, pglob->glob.gl_pathv[index], pglob->flags & GLOB_APPEND, &path);
+			++pglob->index;
 			PHP_STRLCPY(ent->d_name, path, sizeof(ent->d_name), strlen(path));
 			return sizeof(php_stream_dirent);
 		}
-		pglob->index = pglob->glob.gl_pathc;
+		pglob->index = glob_result_count;
 		if (pglob->path) {
 			efree(pglob->path);
 			pglob->path = NULL;
@@ -162,6 +172,9 @@ static int php_glob_stream_close(php_stream *stream, int close_handle)  /* {{{ *
 		if (pglob->pattern) {
 			efree(pglob->pattern);
 		}
+		if (pglob->open_basedir_indexmap) {
+			efree(pglob->open_basedir_indexmap);
+		}
 	}
 	efree(stream->abstract);
 	return 0;
@@ -198,7 +211,7 @@ static php_stream *php_glob_stream_opener(php_stream_wrapper *wrapper, const cha
 		int options, zend_string **opened_path, php_stream_context *context STREAMS_DC)
 {
 	glob_s_t *pglob;
-	int ret;
+	int ret, i;
 	const char *tmp, *pos;
 
 	if (!strncmp(path, "glob://", sizeof("glob://")-1)) {
@@ -208,10 +221,6 @@ static php_stream *php_glob_stream_opener(php_stream_wrapper *wrapper, const cha
 		}
 	}
 
-	if (((options & STREAM_DISABLE_OPEN_BASEDIR) == 0) && php_check_open_basedir(path)) {
-		return NULL;
-	}
-
 	pglob = ecalloc(sizeof(*pglob), 1);
 
 	if (0 != (ret = glob(path, pglob->flags & GLOB_FLAGMASK, NULL, &pglob->glob))) {
@@ -224,6 +233,18 @@ static php_stream *php_glob_stream_opener(php_stream_wrapper *wrapper, const cha
 		}
 	}
 
+	/* if open_basedir in use, check and filter restricted paths */
+	if ((options & STREAM_DISABLE_OPEN_BASEDIR) == 0) {
+		for (i = 0; i < pglob->glob.gl_pathc; i++) {
+			if (!php_check_open_basedir_ex(pglob->glob.gl_pathv[i], 0)) {
+				if (!pglob->open_basedir_indexmap) {
+					pglob->open_basedir_indexmap = (size_t *) emalloc(sizeof(size_t) * pglob->glob.gl_pathc);
+				}
+				pglob->open_basedir_indexmap[pglob->open_basedir_indexmap_size++] = i;
+			}
+		}
+	}
+
 	pos = path;
 	if ((tmp = strrchr(pos, '/')) != NULL) {
 		pos = tmp+1;