diff options
| author | Anatol Belski <ab@php.net> | 2018-03-12 21:02:40 +0100 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2018-03-12 21:02:40 +0100 |
| commit | c469213e7b0e854be929ef108312e1ae2359d14b (patch) | |
| tree | c6b32f0eb92cec88f79ad3239d90da4d2d6557a9 | |
| parent | 16570b8c7994442a73150fc9268447f9b293183d (diff) | |
| parent | 4cd64aad8ad2f85de4a3a1ab8b83ae6108ce9388 (diff) | |
| download | php-git-c469213e7b0e854be929ef108312e1ae2359d14b.tar.gz | |
Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1:
Fix heap use after free
| -rw-r--r-- | ext/pdo_pgsql/pgsql_statement.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/ext/pdo_pgsql/pgsql_statement.c b/ext/pdo_pgsql/pgsql_statement.c index 2d8e3c2fcf..b401917669 100644 --- a/ext/pdo_pgsql/pgsql_statement.c +++ b/ext/pdo_pgsql/pgsql_statement.c @@ -618,11 +618,13 @@ static zend_always_inline char * pdo_pgsql_translate_oid_to_table(Oid oid, PGcon } efree(querystr); - if ((table_name = PQgetvalue(tmp_res, 0, 0)) == NULL) { + if (1 == PQgetisnull(tmp_res, 0, 0) || (table_name = PQgetvalue(tmp_res, 0, 0)) == NULL) { PQclear(tmp_res); return 0; } + table_name = estrdup(table_name); + PQclear(tmp_res); return table_name; } @@ -652,6 +654,7 @@ static int pgsql_stmt_get_column_meta(pdo_stmt_t *stmt, zend_long colno, zval *r table_name = pdo_pgsql_translate_oid_to_table(table_oid, S->H->server); if (table_name) { add_assoc_string(return_value, "table", table_name); + efree(table_name); } switch (S->cols[colno].pgsql_type) { |