archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source
This commit is contained in:
David Carlier 2024-11-15 16:51:10 +00:00
commit 4f76baba29
No known key found for this signature in database
GPG key ID: 8486F847B4B94EF1
2 changed files with 19 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
ext/readline/readline.c
View file

@ -181,7 +181,7 @@ PHP_FUNCTION(readline_info)
add_assoc_long(return_value,"attempted_completion_over",rl_attempted_completion_over); add_assoc_long(return_value,"attempted_completion_over",rl_attempted_completion_over);
} else { } else {
if (zend_string_equals_literal_ci(what,"line_buffer")) { if (zend_string_equals_literal_ci(what,"line_buffer")) {
oldstr = rl_line_buffer; oldstr = strdup(rl_line_buffer ? rl_line_buffer : "");
if (value) { if (value) {
if (!try_convert_to_string(value)) { if (!try_convert_to_string(value)) {
RETURN_THROWS(); RETURN_THROWS();
@ -191,7 +191,8 @@ PHP_FUNCTION(readline_info)
rl_line_buffer = malloc(Z_STRLEN_P(value) + 1); rl_line_buffer = malloc(Z_STRLEN_P(value) + 1);
} else if (strlen(oldstr) < Z_STRLEN_P(value)) { } else if (strlen(oldstr) < Z_STRLEN_P(value)) {
rl_extend_line_buffer(Z_STRLEN_P(value) + 1); rl_extend_line_buffer(Z_STRLEN_P(value) + 1);
oldstr = rl_line_buffer; free(oldstr);
oldstr = strdup(rl_line_buffer ? rl_line_buffer : "");
} }
memcpy(rl_line_buffer, Z_STRVAL_P(value), Z_STRLEN_P(value) + 1); memcpy(rl_line_buffer, Z_STRVAL_P(value), Z_STRLEN_P(value) + 1);
#else #else
@ -208,6 +209,7 @@ PHP_FUNCTION(readline_info)
#endif #endif
} }
RETVAL_STRING(SAFE_STRING(oldstr)); RETVAL_STRING(SAFE_STRING(oldstr));
free(oldstr);
} else if (zend_string_equals_literal_ci(what, "point")) { } else if (zend_string_equals_literal_ci(what, "point")) {
RETVAL_LONG(rl_point); RETVAL_LONG(rl_point);
#ifndef PHP_WIN32 #ifndef PHP_WIN32

15
ext/readline/tests/gh16812.phpt Normal file
View file

@ -0,0 +1,15 @@
--TEST--
GH-16812 readline_info(): UAF
--EXTENSIONS--
readline
--SKIPIF--
<?php
if (getenv('SKIP_REPEAT')) die("skip readline has global state");
?>
--FILE--
<?php
readline_write_history(NULL);
var_dump(readline_info('line_buffer', 'test'));
?>
--EXPECT--
string(0) ""