From 8b06b7e2665e16d1643f7027072dfd3ec34fa0e2 Mon Sep 17 00:00:00 2001 From: Bob Weinand Date: Tue, 20 Dec 2016 20:18:36 +0100 Subject: Fixed bug #73794 (Crash (out of memory) when using run and # command separator) --- sapi/phpdbg/phpdbg_prompt.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'sapi/phpdbg/phpdbg_prompt.c') diff --git a/sapi/phpdbg/phpdbg_prompt.c b/sapi/phpdbg/phpdbg_prompt.c index da2cdfb738..822f25f005 100644 --- a/sapi/phpdbg/phpdbg_prompt.c +++ b/sapi/phpdbg/phpdbg_prompt.c @@ -803,10 +803,13 @@ PHPDBG_COMMAND(run) /* {{{ */ if (param && param->type != EMPTY_PARAM && param->len != 0) { char **argv = emalloc(5 * sizeof(char *)); char *end = param->str + param->len, *p = param->str; + char last_byte; int argc = 0; int i; while (*end == '\r' || *end == '\n') *(end--) = 0; + last_byte = end[1]; + end[1] = 0; while (*p == ' ') p++; while (*p) { @@ -870,6 +873,7 @@ free_cmd: efree(argv[i]); } efree(argv); + end[1] = last_byte; return SUCCESS; } @@ -880,6 +884,8 @@ free_cmd: do p++; while (*p == ' '); } } + end[1] = last_byte; + argv[0] = SG(request_info).argv[0]; for (i = SG(request_info).argc; --i;) { efree(SG(request_info).argv[i]); -- cgit v1.2.1