Skip to content

Commit 18f5afc

Browse files
committed
Fix phpdbg segmentation fault in case of malformed input
If you were to enter "w $>" the function would crash with a segmentation fault because last_index is still NULL at that point. Fix it by checking for NULL and erroring out if it is.
1 parent 7d98e3e commit 18f5afc

File tree

2 files changed

+26
-0
lines changed

2 files changed

+26
-0
lines changed

sapi/phpdbg/phpdbg_utils.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,9 @@ PHPDBG_API int phpdbg_parse_variable_with_arg(char *input, size_t len, HashTable
466466
case ']':
467467
break;
468468
case '>':
469+
if (!last_index) {
470+
goto error;
471+
}
469472
if (last_index[index_len - 1] == '-') {
470473
new_index = 1;
471474
index_len--;

sapi/phpdbg/tests/watch_007.phpt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
Test malformed watchpoint name
3+
--PHPDBG--
4+
b test
5+
r
6+
w $>
7+
q
8+
--EXPECTF--
9+
[Successful compilation of %s]
10+
prompt> [Breakpoint #0 added at test]
11+
prompt> [Breakpoint #0 in test() at %s:%d, hits: 1]
12+
>00004: }
13+
00005: test();
14+
00006: $a = 2;
15+
prompt> [Malformed input]
16+
prompt>
17+
--FILE--
18+
<?php
19+
$a = 1;
20+
function test() {
21+
}
22+
test();
23+
$a = 2;

0 commit comments

Comments
 (0)