From ffa720d90a79c1f33cf4c5a33403d09a67b42a66 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Thu, 18 Apr 2013 05:53:58 -0400
Subject: [PATCH] Prevent null-byte injection in preg_replace()

---
 libraries/Tracker.class.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libraries/Tracker.class.php b/libraries/Tracker.class.php
index 2f50623832..3d27f896a8 100644
--- a/libraries/Tracker.class.php
+++ b/libraries/Tracker.class.php
@@ -877,6 +877,9 @@ class PMA_Tracker
         if (empty($dbname)) {
             return;
         }
+        // Remove null bytes (preg_replace() is vulnerable in some
+        // PHP versions)
+        $dbname = str_replace("\0", "", $dbname);
 
         // If we found a valid statement
         if (isset($result['identifier'])) {