diff options
| author | Xinchen Hui <laruence@gmail.com> | 2015-12-10 15:02:01 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@gmail.com> | 2015-12-10 15:02:01 +0800 |
| commit | 29b615cfcfe07780b52926693a7dc29757fa86bf (patch) | |
| tree | 33efa699bb2088ef3b11fcbff0fcb287f1e945d5 | |
| parent | 7c1ddcc67f2777ce1789bb3f3fc7a614aad8a3dc (diff) | |
| download | php-git-29b615cfcfe07780b52926693a7dc29757fa86bf.tar.gz | |
iFixed key leak with invalid resource
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/dba/dba.c | 17 |
2 files changed, 15 insertions, 5 deletions
@@ -9,6 +9,9 @@ PHP NEWS . Fixed bug #70781 (Extension tests fail on dynamic ext dependency). (Francois Laupretre) +- DBA: + . Fixed key leak with invalid resource. (Laruence) + - Filter: . Fixed bug #71063 (filter_input(INPUT_ENV, ..) does not work). (Reeze Xia) diff --git a/ext/dba/dba.c b/ext/dba/dba.c index 5b73c7d3fb..02413337a4 100644 --- a/ext/dba/dba.c +++ b/ext/dba/dba.c @@ -232,9 +232,10 @@ static size_t php_dba_make_key(zval *key, char **key_str, char **key_free) ZVAL_COPY(&tmp, key); convert_to_string(&tmp); - *key_free = *key_str = estrndup(Z_STRVAL(tmp), Z_STRLEN(tmp)); len = Z_STRLEN(tmp); - + if (Z_STRLEN(tmp)) { + *key_free = *key_str = estrndup(Z_STRVAL(tmp), Z_STRLEN(tmp)); + } zval_ptr_dtor(&tmp); return len; } @@ -281,8 +282,14 @@ static size_t php_dba_make_key(zval *key, char **key_str, char **key_free) RETURN_FALSE; \ } -#define DBA_ID_GET2 DBA_ID_PARS; DBA_GET2; DBA_FETCH_RESOURCE(info, id) -#define DBA_ID_GET2_3 DBA_ID_PARS; DBA_GET2_3; DBA_FETCH_RESOURCE(info, id) +#define DBA_FETCH_RESOURCE_WITH_ID(info, id) \ + if ((info = (dba_info *)zend_fetch_resource2(Z_RES_P(id), "DBA identifier", le_db, le_pdb)) == NULL) { \ + DBA_ID_DONE; \ + RETURN_FALSE; \ + } + +#define DBA_ID_GET2 DBA_ID_PARS; DBA_GET2; DBA_FETCH_RESOURCE_WITH_ID(info, id) +#define DBA_ID_GET2_3 DBA_ID_PARS; DBA_GET2_3; DBA_FETCH_RESOURCE_WITH_ID(info, id) #define DBA_ID_DONE \ if (key_free) efree(key_free) @@ -578,7 +585,7 @@ static void php_dba_update(INTERNAL_FUNCTION_PARAMETERS, int mode) RETURN_FALSE; } - DBA_FETCH_RESOURCE(info, id); + DBA_FETCH_RESOURCE_WITH_ID(info, id); DBA_WRITE_CHECK_WITH_ID; |