From e22f22e6ae83298454576f80b1a91373e7a21ce2 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 31 May 2015 22:53:35 -0700 Subject: Fix bug #69646 OS command injection vulnerability in escapeshellarg --- ext/standard/exec.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ext/standard/exec.c b/ext/standard/exec.c index 683878877b..06c068399d 100644 --- a/ext/standard/exec.c +++ b/ext/standard/exec.c @@ -380,6 +380,14 @@ PHPAPI char *php_escape_shell_arg(char *str) } } #ifdef PHP_WIN32 + if (y > 0 && '\\' == cmd[y - 1]) { + int k = 0, n = y - 1; + for (; n >= 0 && '\\' == cmd[n]; n--, k++); + if (k % 2) { + cmd[y++] = '\\'; + } + } + cmd[y++] = '"'; #else cmd[y++] = '\''; -- cgit v1.2.1