Skip to content

Commit 1b4d38a

Browse files
committed
Fix phpdbg segmentation fault in case of malformed input
If you were to enter "w $>" the function would crash with a segmentation fault because last_index is still NULL at that point. Fix it by checking for NULL and erroring out if it is.
1 parent 7d98e3e commit 1b4d38a

File tree

2 files changed

+28
-0
lines changed

2 files changed

+28
-0
lines changed

sapi/phpdbg/phpdbg_utils.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,9 @@ PHPDBG_API int phpdbg_parse_variable_with_arg(char *input, size_t len, HashTable
466466
case ']':
467467
break;
468468
case '>':
469+
if (!last_index) {
470+
goto error;
471+
}
469472
if (last_index[index_len - 1] == '-') {
470473
new_index = 1;
471474
index_len--;

sapi/phpdbg/tests/watch_007.phpt

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
--TEST--
2+
Test malformed watchpoint name
3+
--INI--
4+
opcache.optimization_level=0
5+
--PHPDBG--
6+
b test
7+
r
8+
w $>
9+
q
10+
--EXPECTF--
11+
[Successful compilation of %s]
12+
prompt> [Breakpoint #0 added at test]
13+
prompt> [Breakpoint #0 in test() at %s:%d, hits: 1]
14+
>00004: }
15+
00005: test();
16+
00006: $a = 2;
17+
prompt> [Malformed input]
18+
prompt>
19+
--FILE--
20+
<?php
21+
$a = 1;
22+
function test() {
23+
}
24+
test();
25+
$a = 2;

0 commit comments

Comments
 (0)