From 78a6f6a90f2fce6f5953b70a496dfd472af62ee9 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Fri, 21 Aug 2026 14:11:26 -0400 Subject: [PATCH] Fix heap over-read in cli_get_prompt() for empty cli.prompt The prompt parser ran as a do-while, so an empty cli.prompt executed the body on the terminator and scanned past it. Use a while loop and return the interned empty string when nothing was appended. No regression test: extra unicode warnings from the over-read depend on heap contents, so a .phpt cannot pin the bug red-before. --- ext/readline/readline_cli.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ext/readline/readline_cli.c b/ext/readline/readline_cli.c index ff5caee9eb7d..05f67880c21d 100644 --- a/ext/readline/readline_cli.c +++ b/ext/readline/readline_cli.c @@ -130,7 +130,7 @@ static zend_string *cli_get_prompt(char *block, char prompt) /* {{{ */ char *prompt_spec = CLIR_G(prompt) ? CLIR_G(prompt) : DEFAULT_PROMPT; bool unicode_warned = false; - do { + while (*prompt_spec) { if (*prompt_spec == '\\') { switch (prompt_spec[1]) { case '\\': @@ -198,8 +198,12 @@ static zend_string *cli_get_prompt(char *block, char prompt) /* {{{ */ smart_str_appendc(&retval, '?'); } } - } while (++prompt_spec && *prompt_spec); + ++prompt_spec; + } smart_str_0(&retval); + if (!retval.s) { + return ZSTR_EMPTY_ALLOC(); + } return retval.s; } /* }}} */