Skip to content

Commit bc5b5db

Browse files
committed
Fix GH-12151: str_getcsv ending with escape zero segfualt
1 parent c2bb9bc commit bc5b5db

File tree

2 files changed

+20
-0
lines changed

2 files changed

+20
-0
lines changed

ext/standard/file.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2023,6 +2023,9 @@ PHPAPI HashTable *php_fgetcsv(php_stream *stream, char delimiter, char enclosure
20232023
if (bptr > limit) {
20242024
/* if the line ends with enclosure, we need to go back by
20252025
* one character so the \0 character is not copied. */
2026+
if (hunk_begin == bptr) {
2027+
--hunk_begin;
2028+
}
20262029
--bptr;
20272030
}
20282031
goto quit_loop_2;
@@ -2038,6 +2041,9 @@ PHPAPI HashTable *php_fgetcsv(php_stream *stream, char delimiter, char enclosure
20382041
if (bptr > limit) {
20392042
/* if the line ends with enclosure, we need to go back by
20402043
* one character so the \0 character is not copied. */
2044+
if (hunk_begin == bptr) {
2045+
--hunk_begin;
2046+
}
20412047
--bptr;
20422048
}
20432049
goto quit_loop_2;
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
GH-12151 (str_getcsv ending with escape zero segfualt)
3+
--FILE--
4+
<?php
5+
var_export(str_getcsv("y","","y","\000"));
6+
var_export(str_getcsv("\0yy","y","y","\0"));
7+
?>
8+
--EXPECT--
9+
array (
10+
0 => '' . "\0" . '',
11+
)array (
12+
0 => '' . "\0" . '',
13+
1 => '' . "\0" . '',
14+
)

0 commit comments

Comments
 (0)