com php-src: Fix bug #69646 OS command inject ion vulnerability in escapeshellarg: ext/standard/exe c.c
| From: | Ferenc Kovacs | Date: | Wed, 10 Jun 2015 07:29:11 +0000 |
| Subject: | com php-src: Fix bug #69646 OS command inject ion vulnerability in escapeshellarg: ext/standard/exe c.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-87151@lists.php.net to get a copy of this message | ||
Commit: d2ac264ffea5ca2e85640b6736e0c7cd4ee9a4a9
Author: Stanislav Malyshev <stas@php.net> Sun, 31 May 2015 22:53:35 -0700
Committer: Ferenc Kovacs <tyrael@php.net> Wed, 10 Jun 2015 09:29:11 +0200
Parents: 8fc52d77d6f66c438c98d536e2309b5fd13f90de
Branches: PHP-5.6.10
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d2ac264ffea5ca2e85640b6736e0c7cd4ee9a4a9
Log:
Fix bug #69646 OS command injection vulnerability in escapeshellarg
Bugs:
https://bugs.php.net/69646
Changed paths:
M ext/standard/exec.c
Diff:
diff --git a/ext/standard/exec.c b/ext/standard/exec.c
index 6838788..06c0683 100644
--- a/ext/standard/exec.c
+++ b/ext/standard/exec.c
@@ -380,6 +380,14 @@ PHPAPI char *php_escape_shell_arg(char *str)
}
}
#ifdef PHP_WIN32
+ if (y > 0 && '\\' == cmd[y - 1]) {
+ int k = 0, n = y - 1;
+ for (; n >= 0 && '\\' == cmd[n]; n--, k++);
+ if (k % 2) {
+ cmd[y++] = '\\';
+ }
+ }
+
cmd[y++] = '"';
#else
cmd[y++] = '\'';