diff options
| author | Christopher Jones <sixd@php.net> | 2010-11-16 19:33:31 +0000 |
|---|---|---|
| committer | Christopher Jones <sixd@php.net> | 2010-11-16 19:33:31 +0000 |
| commit | 314c9b92338c2cffe4e9ce4299d5d39c35751a3a (patch) | |
| tree | 00563494a3344e0110721e578b4461699d07f7ad /ext/oci8/oci8_interface.c | |
| parent | 87fd3737b4a6e64fcdcfa4c8d352a1b99f925302 (diff) | |
| download | php-git-314c9b92338c2cffe4e9ce4299d5d39c35751a3a.tar.gz | |
Protect against null bytes in LOB filenames (rasmus)
Diffstat (limited to 'ext/oci8/oci8_interface.c')
| -rw-r--r-- | ext/oci8/oci8_interface.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/ext/oci8/oci8_interface.c b/ext/oci8/oci8_interface.c index b9e79f9fe9..3143d492ba 100644 --- a/ext/oci8/oci8_interface.c +++ b/ext/oci8/oci8_interface.c @@ -242,7 +242,12 @@ PHP_FUNCTION(oci_lob_import) return; } } - + + if (strlen(filename) != filename_len) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Filename cannot contain null bytes"); + RETURN_FALSE; + } + if (zend_hash_find(Z_OBJPROP_P(z_descriptor), "descriptor", sizeof("descriptor"), (void **)&tmp) == FAILURE) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to find descriptor property"); RETURN_FALSE; @@ -894,7 +899,12 @@ PHP_FUNCTION(oci_lob_export) RETURN_FALSE; } } - + + if (strlen(filename) != filename_len) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Filename cannot contain null bytes"); + RETURN_FALSE; + } + if (zend_hash_find(Z_OBJPROP_P(z_descriptor), "descriptor", sizeof("descriptor"), (void **)&tmp) == FAILURE) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to find descriptor property"); RETURN_FALSE; @@ -1662,8 +1672,8 @@ PHP_FUNCTION(oci_num_fields) } /* }}} */ -/* {{{ proto resource oci_parse(resource connection, string query) - Parse a query and return a statement */ +/* {{{ proto resource oci_parse(resource connection, string statement) + Parse a SQL or PL/SQL statement and return a statement resource */ PHP_FUNCTION(oci_parse) { zval *z_connection; |