diff options
| author | Ferenc Kovacs <tyrael@php.net> | 2015-06-10 10:49:51 +0200 |
|---|---|---|
| committer | Ferenc Kovacs <tyrael@php.net> | 2015-06-10 10:49:51 +0200 |
| commit | dbf30365aa15b9044d75b8f77db570bf8fdf2726 (patch) | |
| tree | e0b4481c39b2852b91037b38fa0ee5ec3776b52b /ext/standard/exec.c | |
| parent | 9cb8cb47975b044bbaafd2d12287ff52cdd3b0e9 (diff) | |
| parent | 5ff259ebb72c1f5cef45c235ca1a85b8e1523835 (diff) | |
| download | php-git-php-7.0.0alpha1.tar.gz | |
Merge remote-tracking branch 'origin/master' into PHP-7.0.0php-7.0.0alpha1
* origin/master:
add missing NEWS entries
add missing NEWS entries
Fixed bug #69646 (OS command injection vulnerability in escapeshellarg)
add NEWS
Fixed bug #68776
fix test
update NEWS
fix typo
Fix bug #69646 OS command injection vulnerability in escapeshellarg
Fix #69719 - more checks for nulls in paths
fix test description
Fixed Buf #68812 Unchecked return value.
Diffstat (limited to 'ext/standard/exec.c')
| -rw-r--r-- | ext/standard/exec.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/ext/standard/exec.c b/ext/standard/exec.c index 71dfc7c361..60fd7ba1aa 100644 --- a/ext/standard/exec.c +++ b/ext/standard/exec.c @@ -383,6 +383,14 @@ PHPAPI zend_string *php_escape_shell_arg(char *str) } } #ifdef PHP_WIN32 + if (y > 0 && '\\' == cmd->val[y - 1]) { + int k = 0, n = y - 1; + for (; n >= 0 && '\\' == cmd->val[n]; n--, k++); + if (k % 2) { + cmd->val[y++] = '\\'; + } + } + cmd->val[y++] = '"'; #else cmd->val[y++] = '\''; |