|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[1998-04-08 00:49 UTC] jaakko
[2011-05-16 17:50 UTC] dtajchreber@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Oct 29 10:00:01 2025 UTC |
Hi, if you launch PHP3 without arguments, in the following code len==0 and the marked line may cause a crash. if (!cgi) { if (!GLOBAL(request_info).query_string) { for (i = optind, len = 0; i < argc; i++) len += strlen(argv[i]) + 1; s = malloc(len + 1); /* leak - but only for command line version, so ok */ *s = '\0'; /* we are pretending it came from the environment */ -> bug here s[len - 1] = '\0'; for (i = optind, len = 0; i < argc; i++) { strcat(s, argv[i]); if (i < (argc - 1)) strcat(s, "+"); } GLOBAL(request_info).query_string = s; } if (!GLOBAL(request_info).filename && argc > optind) GLOBAL(request_info).filename = estrdup(argv[optind]); }