Added NULL byte protection to exec, system and passthru.

Author: Yasuo Ohgaki

NEWS

@@ -46,6 +46,7 @@
   . Removed dl() function on fpm-fcgi. (Nikita)
   . Removed support for hexadecimal numeric strings. (Nikita)
   . Removed obsolete extensions and SAPIs. See the full list in UPGRADING. (Anatol)
+  . Added NULL byte protection to exec, system and passthru. (Yasuo)
 
 - Curl:
   . Fixed bug #68937 (Segfault in curl_multi_exec). (Laruence)

ext/standard/exec.c

@@ -190,7 +190,7 @@ static void php_exec_ex(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 		RETURN_FALSE;
 	}
 	if (strlen(cmd) != cmd_len) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "NULL byte detected. Possible attack");
+		php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
 		RETURN_FALSE;
 	}