Fixed bug #77484 Zend engine crashes when calling realpath in invalid working dir

Author: weltling

Zend/zend_virtual_cwd.c

@@ -764,7 +764,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		if (i == len ||
 			(i + 1 == len && path[i] == '.')) {
 			/* remove double slashes and '.' */
-			len = i - 1;
+			len = EXPECTED(i > 0) ? i - 1 : 0;
 			is_dir = 1;
 			continue;
 		} else if (i + 2 == len && path[i] == '.' && path[i+1] == '.') {

ext/standard/tests/file/realpath_bug77484.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #77484 Zend engine crashes when calling realpath in invalid working dir
+--SKIPIF--
+<?php
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die("skip can't remove CWD on Windows");
+}
+?>
+--FILE--
+<?php
+
+var_dump(\getcwd());
+
+\mkdir(__DIR__ . "/foo");
+\chdir(__DIR__ . "/foo");
+\rmdir(__DIR__ . "/foo");
+
+// Outputs: / (incorrect)
+var_dump(\getcwd());
+
+// Outputs: false (correct)
+var_dump(\realpath(''));
+
+// Crash
+var_dump(\realpath('.'), \realpath('./'));
+
+?>
+--EXPECTF--
+string(%d) "%s"
+bool(false)
+bool(false)
+string(1) "."
+string(1) "."