Skip to content

Commit 11f6022

Browse files
committed
Merge branch 'PHP-8.2'
* PHP-8.2: Fix GH-10187: Segfault in stripslashes() with arm64 Fix memory leak in posix_ttyname()
2 parents f40c3fc + e6c9b17 commit 11f6022

File tree

3 files changed

+21
-9
lines changed

3 files changed

+21
-9
lines changed

ext/posix/posix.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -474,15 +474,15 @@ PHP_FUNCTION(posix_ttyname)
474474
efree(p);
475475
RETURN_FALSE;
476476
}
477-
RETURN_STRING(p);
477+
RETVAL_STRING(p);
478478
efree(p);
479479
#else
480480
if (NULL == (p = ttyname(fd))) {
481481
POSIX_G(last_error) = errno;
482482
RETURN_FALSE;
483483
}
484-
#endif
485484
RETURN_STRING(p);
485+
#endif
486486
}
487487
/* }}} */
488488

ext/standard/string.c

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3821,19 +3821,23 @@ static zend_always_inline char *php_stripslashes_impl(const char *str, char *out
38213821
quad_word q;
38223822
vst1q_u8(q.mem, vceqq_u8(x, vdupq_n_u8('\\')));
38233823
if (q.dw[0] | q.dw[1]) {
3824-
int i = 0;
3825-
for (; i < 16; i++) {
3824+
unsigned int i = 0;
3825+
while (i < 16) {
38263826
if (q.mem[i] == 0) {
38273827
*out++ = str[i];
3828+
i++;
38283829
continue;
38293830
}
38303831

38313832
i++; /* skip the slash */
3832-
char s = str[i];
3833-
if (s == '0')
3834-
*out++ = '\0';
3835-
else
3836-
*out++ = s; /* preserve the next character */
3833+
if (i < len) {
3834+
char s = str[i];
3835+
if (s == '0')
3836+
*out++ = '\0';
3837+
else
3838+
*out++ = s; /* preserve the next character */
3839+
i++;
3840+
}
38373841
}
38383842
str += i;
38393843
len -= i;
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
--TEST--
2+
GH-10187 (Segfault in stripslashes() with arm64)
3+
--FILE--
4+
<?php
5+
var_dump(stripslashes("1234567890abcde\\"));
6+
?>
7+
--EXPECT--
8+
string(15) "1234567890abcde"

0 commit comments

Comments
 (0)