Fixed bug #885: missing validation point returned by strchr in xdebug…

…_error_cb.
xdebug · Oct 21, 2012 · 9405c43 · 9405c43
1 parent f0180b5
commit 9405c43
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/tests/bug00885.phpt b/tests/bug00885.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Test for bug #885: missing validation point returned by strchr in xdebug_error_cb.
+--FILE--
+<?php
+throw new Exception("long message ".str_repeat('.', 10240));
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'Exception' with message 'long message ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... in %sbug00885.php on line 2
diff --git a/xdebug_stack.c b/xdebug_stack.c
@@ -622,8 +622,12 @@ void xdebug_error_cb(int type, const char *error_filename, const uint error_line
 
 				/* find first new line */
 				p = strchr(buffer, '\n');
-				/* find last quote */
+				if (!p) {
-				p = ((char *) zend_memrchr(buffer, '\'', p - buffer)) + 1;
+					p = buffer + strlen(buffer);
+				} else {
+					/* find last quote */
+					p = ((char *) zend_memrchr(buffer, '\'', p - buffer)) + 1;
+				}
 				/* Create new buffer */
 				tmp_buf = calloc(p - buffer + 1, 1);
 				strncpy(tmp_buf, buffer, p - buffer );