MFB: Fixed bug #46798 (Crash in mssql extension when retrieving a NULL value

inside a binary or image column type)

diff --git a/NEWS b/NEWS
index 6339569c458158eb6937e0d10e592af1094a98df..5a883c629a1e3e8b0e8b63bc307b74c50532f084 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,8 +4,10 @@ PHP                                                                        NEWS
 - Fixed security issue in imagerotate(), background colour isn't validated
   correctly with a non truecolour image. (Scott)
 
+- Fixed bug #46798 (Crash in mssql extension when retrieving a NULL value
+  inside a binary or image column type). (Ilia)
 - Fixed bug #46782 (fastcgi.c parse error). (Matt)
-- Fixed bug #46748 (Segfault when an SSL error has more than one error.) (Scott)
+- Fixed bug #46748 (Segfault when an SSL error has more than one error). (Scott)
 - Fixed bug #46739 (array returned by curl_getinfo should contain content_type key). 
   (Mikko)
 

diff --git a/ext/mssql/php_mssql.c b/ext/mssql/php_mssql.c
index c91b98d7dd52a028cb7937ba9b43c285b6e733cf..b9a85ad8032ccf90cdc4ec1d2473b52b3b5a9b67 100644 (file)
--- a/ext/mssql/php_mssql.c
+++ b/ext/mssql/php_mssql.c
@@ -876,11 +876,14 @@ static void php_mssql_get_column_content_with_type(mssql_link *mssql_ptr,int off
                        unsigned char *res_buf;
                        int res_length = dbdatlen(mssql_ptr->link, offset);
 
-                       res_buf = (unsigned char *) emalloc(res_length+1);
-                       bin = ((DBBINARY *)dbdata(mssql_ptr->link, offset));
-                       memcpy(res_buf,bin,res_length);
-                       res_buf[res_length] = '\0';
-                       ZVAL_STRINGL(result, res_buf, res_length, 0);
+                       if (!res_length) {
+                               ZVAL_NULL(result);
+                       } else {
+                               bin = ((DBBINARY *)dbdata(mssql_ptr->link, offset));
+                               res_buf = (unsigned char *) emalloc(res_length+1);
+                               memcpy(res_buf,bin,res_length);
+                               res_buf[res_length] = '\0';
+                               ZVAL_STRINGL(result, res_buf, res_length, 0);
                        }
                        break;
                case SQLNUMERIC: