Skip to content

Commit 398a10a

Browse files
nielsdosGirgias
authored andcommitted
Fix phpdbg segmentation fault in case of malformed input
If you were to enter "w $>" the function would crash with a segmentation fault because last_index is still NULL at that point. Fix it by checking for NULL and erroring out if it is. Closes GH-10353 Signed-off-by: George Peter Banyard <girgias@php.net>
1 parent dfe9c2a commit 398a10a

File tree

3 files changed

+29
-0
lines changed

3 files changed

+29
-0
lines changed

NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ PHP NEWS
4646
. Fix undefined behaviour in phpdbg_load_module_or_extension(). (nielsdos)
4747
. Fix NULL pointer dereference in phpdbg_create_conditional_breal(). (nielsdos)
4848
. Fix GH-9710: phpdbg memory leaks by option "-h" (nielsdos)
49+
. Fix phpdbg segmentation fault in case of malformed input (nielsdos)
4950

5051
- Posix:
5152
. Fix memory leak in posix_ttyname() (girgias)

sapi/phpdbg/phpdbg_utils.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,9 @@ PHPDBG_API int phpdbg_parse_variable_with_arg(char *input, size_t len, HashTable
466466
case ']':
467467
break;
468468
case '>':
469+
if (!last_index) {
470+
goto error;
471+
}
469472
if (last_index[index_len - 1] == '-') {
470473
new_index = 1;
471474
index_len--;

sapi/phpdbg/tests/watch_007.phpt

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
--TEST--
2+
Test malformed watchpoint name
3+
--INI--
4+
opcache.optimization_level=0
5+
--PHPDBG--
6+
b test
7+
r
8+
w $>
9+
q
10+
--EXPECTF--
11+
[Successful compilation of %s]
12+
prompt> [Breakpoint #0 added at test]
13+
prompt> [Breakpoint #0 in test() at %s:%d, hits: 1]
14+
>00004: }
15+
00005: test();
16+
00006: $a = 2;
17+
prompt> [Malformed input]
18+
prompt>
19+
--FILE--
20+
<?php
21+
$a = 1;
22+
function test() {
23+
}
24+
test();
25+
$a = 2;

0 commit comments

Comments
 (0)