Fixed bug #73794 (Crash (out of memory) when using run and # command separator)

1 files changed, 6 insertions, 0 deletions

diff --git a/sapi/phpdbg/phpdbg_prompt.c b/sapi/phpdbg/phpdbg_prompt.c
index da2cdfb738..822f25f005 100644
--- a/sapi/phpdbg/phpdbg_prompt.c
+++ b/sapi/phpdbg/phpdbg_prompt.c
@@ -803,10 +803,13 @@ PHPDBG_COMMAND(run) /* {{{ */
 		if (param && param->type != EMPTY_PARAM && param->len != 0) {
 			char **argv = emalloc(5 * sizeof(char *));
 			char *end = param->str + param->len, *p = param->str;
+			char last_byte;
 			int argc = 0;
 			int i;
 
 			while (*end == '\r' || *end == '\n') *(end--) = 0;
+			last_byte = end[1];
+			end[1] = 0;
 
 			while (*p == ' ') p++;
 			while (*p) {
@@ -870,6 +873,7 @@ free_cmd:
 						efree(argv[i]);
 					}
 					efree(argv);
+					end[1] = last_byte;
 					return SUCCESS;
 				}
 
@@ -880,6 +884,8 @@ free_cmd:
 					do p++; while (*p == ' ');
 				}
 			}
+			end[1] = last_byte;
+
 			argv[0] = SG(request_info).argv[0];
 			for (i = SG(request_info).argc; --i;) {
 				efree(SG(request_info).argv[i]);