diff options
| author | Anatol Belski <ab@php.net> | 2020-06-11 13:09:00 +0200 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2020-06-11 13:12:10 +0200 |
| commit | 2fd278bc211c2102422c8d8ce0905dfc43cb5c7f (patch) | |
| tree | 2f51cefd055ac018fcf2e94d02ed16c1eb610e43 /ext/sqlite3 | |
| parent | 2a6f2d82e14735ca4da4fa6eb9df198ed9ae9890 (diff) | |
| download | php-git-2fd278bc211c2102422c8d8ce0905dfc43cb5c7f.tar.gz | |
sqlite3: Fix possible use after free
Exception should be thrown before the db handle is destroyed.
The backtrace excerpt
==26628== Invalid read of size 4
==26628== at 0x53C49E3: sqlite3_errmsg (in /usr/lib64/libsqlite3.so.0.8.6)
==26628== by 0x38C4E9: zim_sqlite3_open (sqlite3.c:142)
==26628== by 0x8977BF: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1618)
==26628== by 0x8F801E: execute_ex (zend_vm_execute.h:53824)
==26628== by 0x8FC0BB: zend_execute (zend_vm_execute.h:57920)
==26628== by 0x828F54: zend_execute_scripts (zend.c:1672)
==26628== by 0x793C2C: php_execute_script (main.c:2621)
==26628== by 0x8FEA44: do_cli (php_cli.c:964)
==26628== by 0x8FF9DC: main (php_cli.c:1359)
Signed-off-by: Anatol Belski <ab@php.net>
Diffstat (limited to 'ext/sqlite3')
| -rw-r--r-- | ext/sqlite3/sqlite3.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ext/sqlite3/sqlite3.c b/ext/sqlite3/sqlite3.c index 3a3ade7bc3..80f57a4508 100644 --- a/ext/sqlite3/sqlite3.c +++ b/ext/sqlite3/sqlite3.c @@ -136,13 +136,13 @@ PHP_METHOD(sqlite3, open) rc = sqlite3_open_v2(fullpath, &(db_obj->db), flags, NULL); if (rc != SQLITE_OK) { - sqlite3_close(db_obj->db); zend_throw_exception_ex(zend_ce_exception, 0, "Unable to open database: %s", #ifdef HAVE_SQLITE3_ERRSTR db_obj->db ? sqlite3_errmsg(db_obj->db) : sqlite3_errstr(rc)); #else db_obj->db ? sqlite3_errmsg(db_obj->db) : ""); #endif + sqlite3_close(db_obj->db); if (fullpath != filename) { efree(fullpath); } @@ -152,8 +152,8 @@ PHP_METHOD(sqlite3, open) #if SQLITE_HAS_CODEC if (encryption_key_len > 0) { if (sqlite3_key(db_obj->db, encryption_key, encryption_key_len) != SQLITE_OK) { - sqlite3_close(db_obj->db); zend_throw_exception_ex(zend_ce_exception, 0, "Unable to open database: %s", sqlite3_errmsg(db_obj->db)); + sqlite3_close(db_obj->db); return; } } |