Skip to content

Commit 472ca05

Browse files
committed
Fix GH-15208: segfault on empty class/function name.
1 parent 67ce875 commit 472ca05

File tree

2 files changed

+62
-0
lines changed

2 files changed

+62
-0
lines changed

sapi/phpdbg/phpdbg_bp.c

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,11 @@ PHPDBG_API void phpdbg_set_breakpoint_symbol(const char *name, size_t name_len)
405405
{
406406
char *lcname;
407407

408+
if (!name_len) {
409+
phpdbg_error("Empty symbol name");
410+
return;
411+
}
412+
408413
if (*name == '\\') {
409414
name++;
410415
name_len--;
@@ -439,11 +444,22 @@ PHPDBG_API void phpdbg_set_breakpoint_method(const char *class_name, const char
439444
size_t func_len = strlen(func_name);
440445
char *func_lcname, *class_lcname;
441446

447+
if (!class_len) {
448+
phpdbg_error("Empty class name");
449+
return;
450+
}
451+
452+
if (!func_len) {
453+
phpdbg_error("Empty function name");
454+
return;
455+
}
456+
442457
if (*class_name == '\\') {
443458
class_name++;
444459
class_len--;
445460
}
446461

462+
447463
func_lcname = zend_str_tolower_dup(func_name, func_len);
448464
class_lcname = zend_str_tolower_dup(class_name, class_len);
449465

sapi/phpdbg/tests/gh15208.phpt

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
--TEST--
2+
GH-15208 (phpdbg segfault on empty class/function names)
3+
--PHPDBG--
4+
r
5+
c
6+
--FILE--
7+
<?php
8+
9+
function test($function) {
10+
if (str_contains($function, "zend")) {
11+
return;
12+
}
13+
ob_start();
14+
try {
15+
@$function();
16+
} catch (Throwable) {
17+
}
18+
try {
19+
@$function(null);
20+
} catch (Throwable) {
21+
}
22+
try {
23+
@$function(null, null);
24+
} catch (Throwable) {
25+
}
26+
ob_end_clean();
27+
}
28+
29+
foreach (get_defined_functions()["internal"] as $function) {
30+
test($function);
31+
}
32+
?>
33+
--EXPECTF--
34+
[Successful compilation of %s]
35+
%a
36+
Notice: ob_end_clean(): Failed to delete buffer. No buffer to delete in %s on line %d
37+
%A
38+
%a
39+
>00009: @$function();
40+
00010: } catch (Throwable) {
41+
00011: }
42+
prompt> [Cannot set breakpoint in %s, it is not a regular file]
43+
[Breakpoint #1 added at ::]
44+
[Breakpoint #2 added at ]
45+
[Script ended normally]
46+
[The stack contains nothing !]

0 commit comments

Comments
 (0)