Fixed crash with pg_escape_*()

# I'll MFH later.

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 1654f58d5a51989e5ed4d5c7762a7c65e7f6f7c0..934e0413b70a86ed2eb6c4e622fa4fcaeb1bf208 100644 (file)
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -2397,8 +2397,10 @@ PHP_FUNCTION(pg_escape_string)
                return;
        }
 
+       to = (char *)emalloc(len*2+1);
        len = (int)PQescapeString(to, from, strlen(from));
        if (len < 0) {
+               efree(to);
                RETURN_FALSE;
        }
        RETURN_STRINGL(to, len, 0);
@@ -2418,9 +2420,11 @@ PHP_FUNCTION(pg_escape_bytea)
 
        to = (char *)PQescapeBytea((unsigned char*)from, strlen(from), (size_t *)&len);
        if (len < 0) {
+               /* Don't need to free "to" here*/
                RETURN_FALSE;
        }
-       RETURN_STRINGL(to, len, 0);
+       RETURN_STRINGL(to, len, 1);
+       free(to);
 }
 /* }}} */
 #endif