From 3c0341e6f9c802ff50cc4eb08e6b90793d033aad Mon Sep 17 00:00:00 2001 From: Xinchen Hui Date: Thu, 12 May 2016 13:15:33 +0800 Subject: Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free) --- ext/pgsql/pgsql.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'ext/pgsql/pgsql.c') diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c index c196c97ee7..76dfd2a9e5 100644 --- a/ext/pgsql/pgsql.c +++ b/ext/pgsql/pgsql.c @@ -1300,7 +1300,7 @@ static void php_pgsql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) smart_str_append_long(&str, Z_LVAL(args[1]) ^ PGSQL_CONNECT_FORCE_NEW); } } - convert_to_string_ex(&args[i]); + ZVAL_STR(&args[i], zval_get_string(&args[i])); smart_str_appendc(&str, '_'); smart_str_appendl(&str, Z_STRVAL(args[i]), Z_STRLEN(args[i])); } @@ -1327,7 +1327,6 @@ static void php_pgsql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) break; } } - efree(args); if (persistent && PGG(allow_persistent)) { zend_resource *le; @@ -1371,7 +1370,7 @@ static void php_pgsql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) PGG(num_persistent)++; } else { /* we do */ if (le->type != le_plink) { - RETURN_FALSE; + goto err; } /* ensure that the link did not die */ if (PGG(auto_reset_persistent) & 1) { @@ -1422,7 +1421,7 @@ static void php_pgsql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) zend_resource *link; if (index_ptr->type != le_index_ptr) { - RETURN_FALSE; + goto err; } link = (zend_resource *)index_ptr->ptr; @@ -1488,10 +1487,18 @@ static void php_pgsql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) php_pgsql_set_default_link(Z_RES_P(return_value)); cleanup: + for (i = 0; i < ZEND_NUM_ARGS(); i++) { + zval_dtor(&args[i]); + } + efree(args); smart_str_free(&str); return; err: + for (i = 0; i < ZEND_NUM_ARGS(); i++) { + zval_dtor(&args[i]); + } + efree(args); smart_str_free(&str); RETURN_FALSE; } -- cgit v1.2.1