archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-12962: Double free of init_file in phpdbg_prompt.c

Browse source 
See GH-12962 for analysis.

Closes GH-12963.
This commit is contained in:
Niels Dossche 2023-12-17 01:35:15 +01:00
parent 40ccc8ea7e
commit a6d17bffe1
4 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
NEWS
View file

@ -20,6 +20,9 @@ PHP NEWS
. Added workaround for SELinux mprotect execheap issue. . Added workaround for SELinux mprotect execheap issue.
See https://bugzilla.kernel.org/show_bug.cgi?id=218258. (ilutov) See https://bugzilla.kernel.org/show_bug.cgi?id=218258. (ilutov)
- PHPDBG:
. Fixed bug GH-12962 (Double free of init_file in phpdbg_prompt.c). (nielsdos)
21 Dec 2023, PHP 8.2.14 21 Dec 2023, PHP 8.2.14
- Core: - Core:

2
sapi/phpdbg/phpdbg_prompt.c
View file

@ -364,7 +364,7 @@ void phpdbg_init(char *init_file, size_t init_file_len, bool use_default) /* {{{
} }
ZEND_IGNORE_VALUE(asprintf(&init_file, "%s/%s", scan_dir, PHPDBG_INIT_FILENAME)); ZEND_IGNORE_VALUE(asprintf(&init_file, "%s/%s", scan_dir, PHPDBG_INIT_FILENAME));
phpdbg_try_file_init(init_file, strlen(init_file), 1); phpdbg_try_file_init(init_file, strlen(init_file), 0);
free(init_file); free(init_file);
if (i == -1) { if (i == -1) {
break; break;

13
sapi/phpdbg/tests/gh12962.phpt Normal file
View file

@ -0,0 +1,13 @@
--TEST--
GH-12962 (Double free of init_file in phpdbg_prompt.c)
--SKIPIF--
<?php
if (!getenv('TEST_PHPDBG_EXECUTABLE')) die("SKIP: No TEST_PHPDBG_EXECUTABLE specified");
?>
--FILE--
<?php
putenv('PHP_INI_SCAN_DIR='.__DIR__."/gh12962");
passthru($_ENV['TEST_PHPDBG_EXECUTABLE'] . " -q");
?>
--EXPECT--
Executed .phpdbginit

2
sapi/phpdbg/tests/gh12962/.phpdbginit Normal file
View file

@ -0,0 +1,2 @@
ev "Executed .phpdbginit"
q