Skip to content

Commit

Permalink
Fix GH-12151: str_getcsv ending with escape zero segfualt
Browse files Browse the repository at this point in the history
Closes GH-12152
  • Loading branch information
bukka committed Sep 8, 2023
1 parent 5ed5838 commit 64ebadc
Show file tree
Hide file tree
Showing 3 changed files with 24 additions and 0 deletions.
4 changes: 4 additions & 0 deletions NEWS
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@ PHP NEWS
. Fixed bug GH-11972 (RecursiveCallbackFilterIterator regression in 8.1.18).
(nielsdos)

- Standard:
. Fixed bug GH-12151 (str_getcsv ending with escape zero segfualt).
(Jakub Zelenka)

31 Aug 2023, PHP 8.3.0RC1

- Core:
Expand Down
6 changes: 6 additions & 0 deletions ext/standard/file.c
Original file line number Diff line number Diff line change
Expand Up @@ -2023,6 +2023,9 @@ PHPAPI HashTable *php_fgetcsv(php_stream *stream, char delimiter, char enclosure
if (bptr > limit) {
/* if the line ends with enclosure, we need to go back by
* one character so the \0 character is not copied. */
if (hunk_begin == bptr) {
--hunk_begin;
}
--bptr;
}
goto quit_loop_2;
Expand All @@ -2038,6 +2041,9 @@ PHPAPI HashTable *php_fgetcsv(php_stream *stream, char delimiter, char enclosure
if (bptr > limit) {
/* if the line ends with enclosure, we need to go back by
* one character so the \0 character is not copied. */
if (hunk_begin == bptr) {
--hunk_begin;
}
--bptr;
}
goto quit_loop_2;
Expand Down
14 changes: 14 additions & 0 deletions ext/standard/tests/strings/gh12151.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
--TEST--
GH-12151 (str_getcsv ending with escape zero segfualt)
--FILE--
<?php
var_export(str_getcsv("y","","y","\000"));
var_export(str_getcsv("\0yy","y","y","\0"));
?>
--EXPECT--
array (
0 => '' . "\0" . '',
)array (
0 => '' . "\0" . '',
1 => '' . "\0" . '',
)

0 comments on commit 64ebadc

Please sign in to comment.