diff --git a/NEWS b/NEWS index 5f048e0f89a..5e940ee0217 100644 --- a/NEWS +++ b/NEWS @@ -61,6 +61,9 @@ PHP NEWS . Fixed bug #60994 (Reading a multibyte CLOB caps at 8192 chars). (Michael Voříšek) +- PHPDBG: + . Fixed bug GH-10715 (heap buffer overflow on --run option misuse). (nielsdos) + - PGSQL: . Fix GH-10672 (pg_lo_open segfaults in the strict_types mode). (girgias) diff --git a/sapi/phpdbg/phpdbg_out.c b/sapi/phpdbg/phpdbg_out.c index a6eb84de2c1..af2f3b98d2b 100644 --- a/sapi/phpdbg/phpdbg_out.c +++ b/sapi/phpdbg/phpdbg_out.c @@ -143,7 +143,11 @@ PHPDBG_API int phpdbg_vprint(int type, int fd, const char *strfmt, va_list args) return msglen; } - len = phpdbg_process_print(fd, type, msg, msglen); + if (UNEXPECTED(msglen == 0)) { + len = 0; + } else { + len = phpdbg_process_print(fd, type, msg, msglen); + } if (msg) { free(msg); diff --git a/sapi/phpdbg/tests/gh10715.phpt b/sapi/phpdbg/tests/gh10715.phpt new file mode 100644 index 00000000000..13edd9afdd8 Binary files /dev/null and b/sapi/phpdbg/tests/gh10715.phpt differ