From: wharmby at uk dot ibm dot com
Operating system: Windows XP
PHP version: 5.2.6RC4
PHP Bug Type: Scripting Engine problem
Bug description: escaepshellscmd() does not check arg count
Description:
------------
Calling escapeshellcmd() with more than 1 argument does not result in
expected warning msg; any spurious arguments are just ignored.
Suggest changing code to:
PHP_FUNCTION(escapeshellcmd)
{
zval **arg1;
char *cmd = NULL;
if (ZEND_NUM_ARGS()!=1 || zend_get_parameters_ex(1, &arg1) ==
FAILURE)
{
WRONG_PARAM_COUNT;
}
convert_to_string_ex(arg1);
if (Z_STRLEN_PP(arg1)) {
cmd = php_escape_shell_cmd(Z_STRVAL_PP(arg1));
RETVAL_STRING(cmd, 1);
efree(cmd);
}
}
or better still the following based on the code now in PHP 6 :
PHP_FUNCTION(escapeshellcmd)
{
char *command
int command_len;
char *cmd = NULL;
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &command,
&command_len) == FAILURE) {
return;
}
if (command_len) {
cmd = php_escape_shell_cmd(command);
RETVAL_STRING(cmd, 0);
} else {
RETVAL_EMPTY_STRING();
}
}
Reproduce code:
---------------
<?php
$command= "Mr O'Neil";
$extra_arg = 10;
var_dump( escapeshellcmd($command, $extra_arg) );
?>
Expected result:
----------------
A warning msg. With suggested fix the following output will result:
Warning: escapeshellcmd() expects exactly 1 parameter, 2 given in <...>
on line nn
NULL
Actual result:
--------------
Actual Output:
-------------------
string(9) "Mr O Neil"
--
Edit bug report at http://bugs.php.net/?id=44650&edit=1
--
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=44650&r=trysnapshot52
Try a CVS snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=44650&r=trysnapshot53
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=44650&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=44650&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=44650&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=44650&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=44650&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=44650&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=44650&r=support
Expected behavior: http://bugs.php.net/fix.php?id=44650&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=44650&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=44650&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=44650&r=globals
PHP 4 support discontinued: http://bugs.php.net/fix.php?id=44650&r=php4
Daylight Savings: http://bugs.php.net/fix.php?id=44650&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=44650&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=44650&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=44650&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=44650&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=44650&r=mysqlcfg
