Fixed bug #73794 (Crash (out of memory) when using run and # command separator)

Author: bwoebi

NEWS

@@ -39,6 +39,10 @@ PHP                                                                        NEWS
   . Fixed bug #72931 (PDO_FIREBIRD with Firebird 3.0 not work on returning
     statement). (Dorin Marcoci)
 
+- phpdbg:
+  . Fixed bug #73794 (Crash (out of memory) when using run and # command
+    separator). (Bob)
+
 - Standard:
   . Fixed bug #73594 (dns_get_record does not populate $additional out parameter).
     (Bruce Weirdan)

sapi/phpdbg/phpdbg_prompt.c

@@ -803,10 +803,13 @@ PHPDBG_COMMAND(run) /* {{{ */
 		if (param && param->type != EMPTY_PARAM && param->len != 0) {
 			char **argv = emalloc(5 * sizeof(char *));
 			char *end = param->str + param->len, *p = param->str;
+			char last_byte;
 			int argc = 0;
 			int i;
 
 			while (*end == '\r' || *end == '\n') *(end--) = 0;
+			last_byte = end[1];
+			end[1] = 0;
 
 			while (*p == ' ') p++;
 			while (*p) {
@@ -870,6 +873,7 @@ PHPDBG_COMMAND(run) /* {{{ */
 						efree(argv[i]);
 					}
 					efree(argv);
+					end[1] = last_byte;
 					return SUCCESS;
 				}
 
@@ -880,6 +884,8 @@ PHPDBG_COMMAND(run) /* {{{ */
 					do p++; while (*p == ' ');
 				}
 			}
+			end[1] = last_byte;
+
 			argv[0] = SG(request_info).argv[0];
 			for (i = SG(request_info).argc; --i;) {
 				efree(SG(request_info).argv[i]);

sapi/phpdbg/tests/bug73794.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #73794 (Crash (out of memory) when using run and # command separator)
+--PHPDBG--
+r echo # quit
+--EXPECTF--
+[Successful compilation of %s]
+prompt> echo
+--FILE--
+<?php
+echo $argv[1];
+?>