From 1143155fcb4c54738c2b32f7e5bce0dc16249f1a Mon Sep 17 00:00:00 2001
From: Joe Watkins <krakjoe@php.net>
Date: Sat, 22 May 2021 16:50:00 +0200
Subject: [PATCH] fix bug #72998

the function fn_complete in libedit null checks matches[2]
---
 NEWS                    | 3 +++
 ext/readline/readline.c | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index ab4f773b68..8cb86c74db 100644
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,9 @@ PHP                                                                        NEWS
 - MySQLnd:
   . Fixed bug #80761 (PDO uses too much memory). (Nikita)
 
+- readline:
+  . Fixed bug #72998 (invalid read in readline completion). (krakjoe)
+
 - Standard:
   . Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
     (cmb)
diff --git a/ext/readline/readline.c b/ext/readline/readline.c
index 647eb0977f..f780ca8b39 100644
--- a/ext/readline/readline.c
+++ b/ext/readline/readline.c
@@ -452,12 +452,12 @@ char **php_readline_completion_cb(const char *text, int start, int end)
 			if (zend_hash_num_elements(Z_ARRVAL(_readline_array))) {
 				matches = rl_completion_matches(text,_readline_command_generator);
 			} else {
-				matches = malloc(sizeof(char *) * 2);
+				/* libedit will read matches[2] */
+				matches = calloc(sizeof(char *), 3);
 				if (!matches) {
 					return NULL;
 				}
 				matches[0] = strdup("");
-				matches[1] = NULL;
 			}
 		}
 	}