diff options
| author | Felipe Pena <felipe@php.net> | 2009-10-12 19:04:00 +0000 |
|---|---|---|
| committer | Felipe Pena <felipe@php.net> | 2009-10-12 19:04:00 +0000 |
| commit | 6637fd092f173964d242b4bf27dc9cb0852a9f16 (patch) | |
| tree | 7a5ba7e4f639d09e15a8a08f87c99d1b32f01ed6 | |
| parent | d41c132f0a4f272f86e6426c9195831040dcc579 (diff) | |
| download | php-git-6637fd092f173964d242b4bf27dc9cb0852a9f16.tar.gz | |
- Fixed possible crash when calling SQLiteDatabase::{ArrayQuery, SingleQuery} methods using Reflection
| -rw-r--r-- | ext/sqlite/sqlite.c | 2 | ||||
| -rw-r--r-- | ext/sqlite/tests/sqlitedatabase_arrayquery.phpt | 23 |
2 files changed, 24 insertions, 1 deletions
diff --git a/ext/sqlite/sqlite.c b/ext/sqlite/sqlite.c index 01c52eda49..f4b9f557af 100644 --- a/ext/sqlite/sqlite.c +++ b/ext/sqlite/sqlite.c @@ -175,7 +175,7 @@ PHP_INI_END() #define RES_FROM_OBJECT(res, object) RES_FROM_OBJECT_RESTORE_ERH(res, object, NULL) #define PHP_SQLITE_EMPTY_QUERY \ - if (!sql_len) { \ + if (!sql_len || !*sql) { \ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot execute empty query"); \ RETURN_FALSE; \ } diff --git a/ext/sqlite/tests/sqlitedatabase_arrayquery.phpt b/ext/sqlite/tests/sqlitedatabase_arrayquery.phpt new file mode 100644 index 0000000000..1e3084cebe --- /dev/null +++ b/ext/sqlite/tests/sqlitedatabase_arrayquery.phpt @@ -0,0 +1,23 @@ +--TEST-- +Testing SQLiteDatabase::ArrayQuery with NULL-byte string +--SKIPIF-- +<?php +if (!extension_loaded("sqlite")) print "skip"; +?> +--FILE-- +<?php + +$method = new ReflectionMethod('sqlitedatabase::arrayquery'); + +$class = $method->getDeclaringClass()->newInstanceArgs(array(':memory:')); + +$p = "\0"; + +$method->invokeArgs($class, array_fill(0, 2, $p)); +$method->invokeArgs($class, array_fill(0, 1, $p)); + +?> +--EXPECTF-- +Warning: SQLiteDatabase::arrayQuery() expects parameter 2 to be long, string given in %s on line %d + +Warning: SQLiteDatabase::arrayQuery(): Cannot execute empty query. in %s on line %d |