(This web form will probably eat the diff, so you can also get it here: http://www.cs.ucsd.edu/~sbrown/php-shell_exec-fix.diff)

If PHP is resource-starved and can't popen, the shell_exec function detects the error but forgets to return, resulting in a NULL (FILE *) being passed to fread on line 466 of exec.c (PHP 4.2.0) which causes a crash.  This patch adds the missing RETURN_FALSE.

Steven Brown <swbrown@ucsd.edu>


--- php-4.2.0/ext/standard/exec.c	Tue Dec 11 07:30:29 2001
+++ php-4.2.0-fixed/ext/standard/exec.c	Wed Apr 24 15:39:56 2002
@@ -459,6 +459,7 @@
 	if ((in=VCWD_POPEN(Z_STRVAL_PP(cmd), "r"))==NULL) {
 #endif
 		php_error(E_WARNING, "Unable to execute '%s'", Z_STRVAL_PP(cmd));
+		RETURN_FALSE;
 	}
 	allocated_space = EXEC_INPUT_BUF;
 	ret = (char *) emalloc(allocated_space);