fix bug #72998

the function fn_complete in libedit null checks matches[2]

Author: krakjoe

NEWS

@@ -28,6 +28,9 @@ PHP                                                                        NEWS
 - MySQLnd:
   . Fixed bug #80761 (PDO uses too much memory). (Nikita)
 
+- readline:
+  . Fixed bug #72998 (invalid read in readline completion). (krakjoe)
+
 - Standard:
   . Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
     (cmb)

ext/readline/readline.c

@@ -452,12 +452,12 @@ char **php_readline_completion_cb(const char *text, int start, int end)
 			if (zend_hash_num_elements(Z_ARRVAL(_readline_array))) {
 				matches = rl_completion_matches(text,_readline_command_generator);
 			} else {
-				matches = malloc(sizeof(char *) * 2);
+				/* libedit will read matches[2] */
+				matches = calloc(sizeof(char *), 3);
 				if (!matches) {
 					return NULL;
 				}
 				matches[0] = strdup("");
-				matches[1] = NULL;
 			}
 		}
 	}