MFB: Fixed bug #39663 (Memory leak in pg_get_notify() and a possible memory

corruption on Windows in pgsql and pdo_pgsql extensions).

diff --git a/ext/pdo_pgsql/pgsql_driver.c b/ext/pdo_pgsql/pgsql_driver.c
index 2ed26595835592da61811e3ec3d9b5bc0d5c3a04..053fa1ac21d63018aa8d8ddbd5ca557a3a97c27f 100644 (file)
--- a/ext/pdo_pgsql/pgsql_driver.c
+++ b/ext/pdo_pgsql/pgsql_driver.c
@@ -267,7 +267,7 @@ static int pgsql_handle_quoter(pdo_dbh_t *dbh, const char *unquoted, int unquote
                        (*quoted)[0] = '\'';
                        (*quoted)[*quotedlen-1] = '\'';
                        (*quoted)[*quotedlen] = '\0';
-                       free(escaped);
+                       PQfreemem(escaped);
                        break;
                default:
                        *quoted = safe_emalloc(2, unquotedlen, 3);

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index f8dfbcea9e790c4d50a34cfb323366bded18abe8..e6204533dc70992c403fade6462cd2f524669dbe 100644 (file)
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -3597,7 +3597,7 @@ PHP_FUNCTION(pg_escape_bytea)
                to = (char *)PQescapeBytea((unsigned char*)from, from_len, &to_len);
 
        RETVAL_STRINGL(to, to_len-1, 1); /* to_len includes addtional '\0' */
-       free(to);
+       PQfreemem(to);
 }
 /* }}} */
 
@@ -4335,6 +4335,7 @@ PHP_FUNCTION(pg_get_notify)
                add_assoc_string(return_value, "message", pgsql_notify->relname, 1);
                add_assoc_long(return_value, "pid", pgsql_notify->be_pid);
        }
+       PQfreemem(pgsql_notify);
 }
 /* }}} */
 
@@ -5140,7 +5141,7 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
                                                        Z_STRLEN_P(new_val) = to_len-1; /* PQescapeBytea's to_len includes additional '\0' */
                                                        Z_STRVAL_P(new_val) = emalloc(to_len);
                                                        memcpy(Z_STRVAL_P(new_val), tmp, to_len);
-                                                       free(tmp);
+                                                       PQfreemem(tmp);
                                                        php_pgsql_add_quotes(new_val, 1 TSRMLS_CC);
                                                                
                                                }