Buffer Overflow in PHP of the AirMax Products

Vulnerability The function `static int ub_normalize_filename(char* filename)` (implemented by the patch `430-smart-post-upload.patch` in the file `uploadbuffer.c` on the `SDK.UBNT.v5.5`) have the following code:

static int ub_normalize_filename(char* filename)
{

    char *fwd_slash;
    char *back_slash;
    size_t size;
    /**
     *  Some comments removed
     */
    if (filename == 0)
    {
        return -1;
    }
    size = strlen(filename);
    fwd_slash = strrchr(filename, '/');
    back_slash = …