mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 01:44:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source
This commit is contained in:
David Carlier 2024-11-15 16:51:10 +00:00
commit 4f76baba29
No known key found for this signature in database
GPG Key ID: 8486F847B4B94EF1
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ext/readline/readline.c
View File

@ -181,7 +181,7 @@ PHP_FUNCTION(readline_info)
add_assoc_long(return_value,"attempted_completion_over",rl_attempted_completion_over);
} else {
if (zend_string_equals_literal_ci(what,"line_buffer")) {
oldstr = rl_line_buffer;
oldstr = strdup(rl_line_buffer ? rl_line_buffer : "");
if (value) {
if (!try_convert_to_string(value)) {
RETURN_THROWS();
@ -191,7 +191,8 @@ PHP_FUNCTION(readline_info)
rl_line_buffer = malloc(Z_STRLEN_P(value) + 1);
} else if (strlen(oldstr) < Z_STRLEN_P(value)) {
rl_extend_line_buffer(Z_STRLEN_P(value) + 1);
oldstr = rl_line_buffer;
free(oldstr);
oldstr = strdup(rl_line_buffer ? rl_line_buffer : "");
}
memcpy(rl_line_buffer, Z_STRVAL_P(value), Z_STRLEN_P(value) + 1);
#else
@ -208,6 +209,7 @@ PHP_FUNCTION(readline_info)
#endif
}
RETVAL_STRING(SAFE_STRING(oldstr));
free(oldstr);
} else if (zend_string_equals_literal_ci(what, "point")) {
RETVAL_LONG(rl_point);
#ifndef PHP_WIN32

15
ext/readline/tests/gh16812.phpt Normal file
View File

@ -0,0 +1,15 @@
--TEST--
GH-16812 readline_info(): UAF
--EXTENSIONS--
readline
--SKIPIF--
<?php
if (getenv('SKIP_REPEAT')) die("skip readline has global state");
?>
--FILE--
<?php
readline_write_history(NULL);
var_dump(readline_info('line_buffer', 'test'));
?>
--EXPECT--
string(0) ""