Skip to content

Commit 70be6a2

Browse files
committed
Fix GH-15208: segfault on empty class/function name.
1 parent 67ce875 commit 70be6a2

File tree

2 files changed

+57
-0
lines changed

2 files changed

+57
-0
lines changed

sapi/phpdbg/phpdbg_bp.c

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,11 @@ PHPDBG_API void phpdbg_set_breakpoint_symbol(const char *name, size_t name_len)
405405
{
406406
char *lcname;
407407

408+
if (!name_len) {
409+
phpdbg_error("Empty symbol name");
410+
return;
411+
}
412+
408413
if (*name == '\\') {
409414
name++;
410415
name_len--;
@@ -439,11 +444,22 @@ PHPDBG_API void phpdbg_set_breakpoint_method(const char *class_name, const char
439444
size_t func_len = strlen(func_name);
440445
char *func_lcname, *class_lcname;
441446

447+
if (!class_len) {
448+
phpdbg_error("Empty class name");
449+
return;
450+
}
451+
452+
if (!func_len) {
453+
phpdbg_error("Empty function name");
454+
return;
455+
}
456+
442457
if (*class_name == '\\') {
443458
class_name++;
444459
class_len--;
445460
}
446461

462+
447463
func_lcname = zend_str_tolower_dup(func_name, func_len);
448464
class_lcname = zend_str_tolower_dup(class_name, class_len);
449465

sapi/phpdbg/tests/gh15208.phpt

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
--TEST--
2+
GH-15208 (phpdbg segfault on empty class/function names)
3+
--PHPDBG--
4+
r
5+
c
6+
--FILE--
7+
<?php
8+
9+
function test($function) {
10+
if ($function == "zend_test_crash")
11+
return;
12+
ob_start();
13+
try {
14+
@$function();
15+
} catch (Throwable) {
16+
}
17+
try {
18+
@$function(null);
19+
} catch (Throwable) {
20+
}
21+
try {
22+
@$function(null, null);
23+
} catch (Throwable) {
24+
}
25+
ob_end_clean();
26+
}
27+
28+
foreach (get_defined_functions()["internal"] as $function) {
29+
test($function);
30+
}
31+
?>
32+
--EXPECTF--
33+
[Successful compilation of %s]
34+
prompt>
35+
Notice: ob_end_clean(): Failed to delete buffer. No buffer to delete in %s on line %d
36+
37+
Fatal error: zend_test_array_return(): Return value must be of type array, null returned in Unknown on line 0
38+
[Script ended normally]
39+
prompt> [Not running]
40+
prompt> [Not running]
41+
prompt>

0 commit comments

Comments
 (0)