Fix bug #69646 OS command injection vulnerability in escapeshellarg

smalyshev · smalyshev · commit 803675849108 · 2015-06-09T10:52:38.000-07:00
diff --git a/ext/standard/exec.c b/ext/standard/exec.c
@@ -380,6 +380,14 @@ PHPAPI char *php_escape_shell_arg(char *str)
 		}
 	}
 #ifdef PHP_WIN32
+	if (y > 0 && '\\' == cmd[y - 1]) {
+		int k = 0, n = y - 1;
+		for (; n >= 0 && '\\' == cmd[n]; n--, k++);
+		if (k % 2) {
+			cmd[y++] = '\\';
+		}
+	}
+
 	cmd[y++] = '"';
 #else
 	cmd[y++] = '\'';
