com php-src: Fixed bug #69646 (OS command injection vulnerability in escapeshellarg): ext/standard/exec.c
| From: | Stanislav Malyshev | Date: | Wed, 10 Jun 2015 04:37:17 +0000 |
| Subject: | com php-src: Fixed bug #69646 (OS command injection vulnerability in escapeshellarg): ext/standard/exec.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-87144@lists.php.net to get a copy of this message | ||
Commit: 563462fbf8c45c5fe54c6b215d6ec76b5b3f867c
Author: Stanislav Malyshev <stas@php.net> Tue, 9 Jun 2015 21:37:17 -0700
Parents: e4aa5c0510fb3c8b41eb8a999105368599240214
Branches: master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=563462fbf8c45c5fe54c6b215d6ec76b5b3f867c
Log:
Fixed bug #69646 (OS command injection vulnerability in escapeshellarg)
Bugs:
https://bugs.php.net/69646
Changed paths:
M ext/standard/exec.c
Diff:
diff --git a/ext/standard/exec.c b/ext/standard/exec.c
index 71dfc7c..60fd7ba 100644
--- a/ext/standard/exec.c
+++ b/ext/standard/exec.c
@@ -383,6 +383,14 @@ PHPAPI zend_string *php_escape_shell_arg(char *str)
}
}
#ifdef PHP_WIN32
+ if (y > 0 && '\\' == cmd->val[y - 1]) {
+ int k = 0, n = y - 1;
+ for (; n >= 0 && '\\' == cmd->val[n]; n--, k++);
+ if (k % 2) {
+ cmd->val[y++] = '\\';
+ }
+ }
+
cmd->val[y++] = '"';
#else
cmd->val[y++] = '\'';