Fix bug #69646 OS command injection vulnerability in escapeshellarg

diff --git a/ext/standard/exec.c b/ext/standard/exec.c
index d6938a480950b8d72dc849ed070e501b271bcaf5..d0b1e01e1675fbbdbd8ce85c7ad409e259ff5b87 100644 (file)
--- a/ext/standard/exec.c
+++ b/ext/standard/exec.c
@@ -380,6 +380,14 @@ PHPAPI char *php_escape_shell_arg(char *str)
                }
        }
 #ifdef PHP_WIN32
+       if (y > 0 && '\\' == cmd[y - 1]) {
+               int k = 0, n = y - 1;
+               for (; n >= 0 && '\\' == cmd[n]; n--, k++);
+               if (k % 2) {
+                       cmd[y++] = '\\';
+               }
+       }
+
        cmd[y++] = '"';
 #else
        cmd[y++] = '\'';