From: Xinchen Hui <laruence@php.net>
Date: Wed, 8 Jul 2015 11:06:49 +0000 (+0800)
Subject: Fixed invalid read
X-Git-Tag: php-5.6.12RC1~43
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=94957a7091d2d87d3b75c8395a3a11a4fbecaea1;p=php

Fixed invalid read
---

diff --git a/ext/standard/exec.c b/ext/standard/exec.c
index 66d4537dab..4764f4bf33 100644
--- a/ext/standard/exec.c
+++ b/ext/standard/exec.c
@@ -115,7 +115,7 @@ PHPAPI int php_exec(int type, char *cmd, zval *array, zval *return_value TSRMLS_
 			} else if (type == 2) {
 				/* strip trailing whitespaces */
 				l = bufl;
-				while (l-- && isspace(((unsigned char *)buf)[l]));
+				while (--l >= 0 && isspace(((unsigned char *)buf)[l]));
 				if (l != (int)(bufl - 1)) {
 					bufl = l + 1;
 					buf[bufl] = '\0';
@@ -128,7 +128,7 @@ PHPAPI int php_exec(int type, char *cmd, zval *array, zval *return_value TSRMLS_
 			/* strip trailing whitespaces if we have not done so already */
 			if ((type == 2 && buf != b) || type != 2) {
 				l = bufl;
-				while (l-- && isspace(((unsigned char *)buf)[l]));
+				while (--l >= 0 && isspace(((unsigned char *)buf)[l]));
 				if (l != (int)(bufl - 1)) {
 					bufl = l + 1;
 					buf[bufl] = '\0';