From 563462fbf8c45c5fe54c6b215d6ec76b5b3f867c Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Tue, 9 Jun 2015 21:37:17 -0700 Subject: [PATCH] Fixed bug #69646 (OS command injection vulnerability in escapeshellarg) --- ext/standard/exec.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ext/standard/exec.c b/ext/standard/exec.c index 71dfc7c361..60fd7ba1aa 100644 --- a/ext/standard/exec.c +++ b/ext/standard/exec.c @@ -383,6 +383,14 @@ PHPAPI zend_string *php_escape_shell_arg(char *str) } } #ifdef PHP_WIN32 + if (y > 0 && '\\' == cmd->val[y - 1]) { + int k = 0, n = y - 1; + for (; n >= 0 && '\\' == cmd->val[n]; n--, k++); + if (k % 2) { + cmd->val[y++] = '\\'; + } + } + cmd->val[y++] = '"'; #else cmd->val[y++] = '\''; -- 2.40.0