iliaa Tue Oct 11 12:19:15 2005 EDT
Modified files: (Branch: PHP_5_1)
/php-src/ext/pgsql pgsql.c
/php-src NEWS
Log:
MFH: Fixed bug #33167 (Possible crash inside pg_fetch_array()).
http://cvs.php.net/diff.php/php-src/ext/pgsql/pgsql.c?r1=1.331.2.1&r2=1.331.2.2&ty=u
Index: php-src/ext/pgsql/pgsql.c
diff -u php-src/ext/pgsql/pgsql.c:1.331.2.1 php-src/ext/pgsql/pgsql.c:1.331.2.2
--- php-src/ext/pgsql/pgsql.c:1.331.2.1 Tue Aug 16 05:55:44 2005
+++ php-src/ext/pgsql/pgsql.c Tue Oct 11 12:19:13 2005
@@ -20,7 +20,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: pgsql.c,v 1.331.2.1 2005/08/16 09:55:44 edink Exp $ */
+/* $Id: pgsql.c,v 1.331.2.2 2005/10/11 16:19:13 iliaa Exp $ */
#include <stdlib.h>
@@ -1872,11 +1872,11 @@
/* {{{ void php_pgsql_fetch_hash */
static void php_pgsql_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, long
result_type, int into_object)
{
- zval *result, *zrow;
+ zval *result;
PGresult *pgsql_result;
pgsql_result_handle *pg_result;
int i, num_fields, pgsql_row, use_row;
- long row;
+ long row = -1;
char *element, *field_name;
uint element_len;
zval *ctor_params = NULL;
@@ -1886,9 +1886,9 @@
char *class_name;
int class_name_len;
- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|zsz",
&result, &zrow, &class_name, &class_name_len, &ctor_params) == FAILURE) {
+ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|lsz",
&result, &row, &class_name, &class_name_len, &ctor_params) == FAILURE) {
return;
- }
+ }
if (ZEND_NUM_ARGS() < 3) {
ce = zend_standard_class_def;
} else {
@@ -1900,15 +1900,11 @@
}
result_type = PGSQL_ASSOC;
} else {
- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|zl",
&result, &zrow, &result_type) == FAILURE) {
+ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|ll",
&result, &row, &result_type) == FAILURE) {
return;
}
}
- use_row = ZEND_NUM_ARGS() > 1 && Z_TYPE_P(zrow) != IS_NULL;
- if (use_row) {
- convert_to_long_ex(&zrow);
- row = Z_LVAL_P(zrow);
- }
+ use_row = ZEND_NUM_ARGS() > 1 && row != -1;
if (!(result_type & PGSQL_BOTH)) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid result
type");
http://cvs.php.net/diff.php/php-src/NEWS?r1=1.2027.2.118&r2=1.2027.2.119&ty=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.118 php-src/NEWS:1.2027.2.119
--- php-src/NEWS:1.2027.2.118 Tue Oct 11 10:33:51 2005
+++ php-src/NEWS Tue Oct 11 12:19:14 2005
@@ -116,6 +116,7 @@
- Fixed bug #34199 (if($obj)/if(!$obj) inconsistency because of cast handler).
(Dmitry, Alex)
- Fixed bug #34191 (ob_gzhandler does not enforce trailing \0). (Ilia)
+- Fixed bug #33167 (Possible crash inside pg_fetch_array()). (Ilia)
- Fixed bug #34156 (memory usage remains elevated after memory limit is
reached). (Ilia)
- Fixed bug #34148 (+,- and . not supported as parts of scheme). (Ilia)
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
