Fixed possible crash inside pg_copy_(to|from) function if delimiter is more

then 1 character long.

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 30916a7beeba14a30a322db5f5c738f8ea475a35..81f67494637e9bb916289de43241eea9bc3d4a4d 100644 (file)
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -2658,8 +2658,8 @@ PHP_FUNCTION(pg_copy_to)
        ZEND_FETCH_RESOURCE2(pgsql, PGconn *, &pgsql_link, id, "PostgreSQL link", le_link, le_plink);
 
        query = (char *)emalloc(strlen(query_template) + strlen(table_name) + strlen(pg_null_as) + 1);
-       sprintf(query, "COPY \"%s\" TO STDOUT DELIMITERS '%s' WITH NULL AS '%s'",
-                       table_name,     pg_delim, pg_null_as);
+       sprintf(query, "COPY \"%s\" TO STDOUT DELIMITERS '%c' WITH NULL AS '%s'",
+                       table_name, *pg_delim, pg_null_as);
 
        while ((pgsql_result = PQgetResult(pgsql))) {
                PQclear(pgsql_result);
@@ -2768,8 +2768,8 @@ PHP_FUNCTION(pg_copy_from)
        ZEND_FETCH_RESOURCE2(pgsql, PGconn *, &pgsql_link, id, "PostgreSQL link", le_link, le_plink);
 
        query = (char *)emalloc(strlen(query_template) + strlen(table_name) + strlen(pg_null_as) + 1);
-       sprintf(query, "COPY \"%s\" FROM STDIN DELIMITERS '%s' WITH NULL AS '%s'",
-                       table_name, pg_delim, pg_null_as);
+       sprintf(query, "COPY \"%s\" FROM STDIN DELIMITERS '%c' WITH NULL AS '%s'",
+                       table_name, *pg_delim, pg_null_as);
        while ((pgsql_result = PQgetResult(pgsql))) {
                PQclear(pgsql_result);
        }