Fixed Bug #64949 (Buffer overflow in _pdo_pgsql_error)

There is a lot of call such as:
	pdo_pgsql_error(dbh, PGRES_FATAL_ERROR, "Copy command failed");
Where the 3rd paramater is a error message string where a sqlstate (5 chars)
is expected. This cause a segfault in copy_from.phpt and copy_to.phpt.

This is only a sanity check to avoid buffer overflow, but obviously this
calls need to be fixed (using NULL or a correct sqlstate).

diff --git a/NEWS b/NEWS
index 50d979a5f02517a67482243e2fb5753eeadd8522..0b9e7cb9dbef87a438698ca843158960cc6d384d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2013, PHP 5.3.27
 
+- PDO_pgsql:
+  . Fixed Bug #64949 (Buffer overflow in _pdo_pgsql_error). (Remi)
+
 ?? ??? 2013, PHP 5.3.26
 
 ### DO NOT ADD ENTRIES HERE, ADD THEM ABOVE FOR 5.3.27 ###

diff --git a/ext/pdo_pgsql/pgsql_driver.c b/ext/pdo_pgsql/pgsql_driver.c
index 645fd36e8472014fcf57e5e6a1d1de096a253b86..55f441808e28da26eda7922e257021cda3222679 100644 (file)
--- a/ext/pdo_pgsql/pgsql_driver.c
+++ b/ext/pdo_pgsql/pgsql_driver.c
@@ -76,7 +76,7 @@ int _pdo_pgsql_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, int errcode, const char *
                einfo->errmsg = NULL;
        }
 
-       if (sqlstate == NULL) {
+       if (sqlstate == NULL || strlen(sqlstate) >= sizeof(pdo_error_type)) {
                strcpy(*pdo_err, "HY000");
        }
        else {