diff options
| author | Felipe Pena <felipe@php.net> | 2009-10-12 19:04:00 +0000 |
|---|---|---|
| committer | Felipe Pena <felipe@php.net> | 2009-10-12 19:04:00 +0000 |
| commit | 16be0343d701a52c451d13657d1503a04811b3b5 (patch) | |
| tree | 892b5feccb1fb1e500baf5962eed0e537bdd31e6 /ext/sqlite | |
| parent | b394a75ad56377504974770cff89c54fbad8a97e (diff) | |
| download | php-git-16be0343d701a52c451d13657d1503a04811b3b5.tar.gz | |
- Fixed possible crash when calling SQLiteDatabase::{ArrayQuery, SingleQuery} methods using Reflection
Diffstat (limited to 'ext/sqlite')
| -rw-r--r-- | ext/sqlite/sqlite.c | 2 | ||||
| -rw-r--r-- | ext/sqlite/tests/sqlitedatabase_arrayquery.phpt | 23 |
2 files changed, 24 insertions, 1 deletions
diff --git a/ext/sqlite/sqlite.c b/ext/sqlite/sqlite.c index f9b47c9a74..d8c5f6a850 100644 --- a/ext/sqlite/sqlite.c +++ b/ext/sqlite/sqlite.c @@ -129,7 +129,7 @@ PHP_INI_END() #define RES_FROM_OBJECT(res, object) RES_FROM_OBJECT_RESTORE_ERH(res, object, NULL) #define PHP_SQLITE_EMPTY_QUERY \ - if (!sql_len) { \ + if (!sql_len || !*sql) { \ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot execute empty query."); \ RETURN_FALSE; \ } diff --git a/ext/sqlite/tests/sqlitedatabase_arrayquery.phpt b/ext/sqlite/tests/sqlitedatabase_arrayquery.phpt new file mode 100644 index 0000000000..1e3084cebe --- /dev/null +++ b/ext/sqlite/tests/sqlitedatabase_arrayquery.phpt @@ -0,0 +1,23 @@ +--TEST-- +Testing SQLiteDatabase::ArrayQuery with NULL-byte string +--SKIPIF-- +<?php +if (!extension_loaded("sqlite")) print "skip"; +?> +--FILE-- +<?php + +$method = new ReflectionMethod('sqlitedatabase::arrayquery'); + +$class = $method->getDeclaringClass()->newInstanceArgs(array(':memory:')); + +$p = "\0"; + +$method->invokeArgs($class, array_fill(0, 2, $p)); +$method->invokeArgs($class, array_fill(0, 1, $p)); + +?> +--EXPECTF-- +Warning: SQLiteDatabase::arrayQuery() expects parameter 2 to be long, string given in %s on line %d + +Warning: SQLiteDatabase::arrayQuery(): Cannot execute empty query. in %s on line %d |