MFH: Fixed bug #34884 (Possible crash in ext/sqlite when sqlite.assoc_case

is being used).

diff --git a/NEWS b/NEWS
index 54bce65505f257a0c9dc35200f1b16563e7d7ef0..573c9b68c0d9f1601e4649c0b7e9936cc6ceb3e2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Oct 2005, PHP 5.1 Release Candidate 3
 - Fixed bug #34873 (Segmentation Fault on foreach in object). (Dmitry)
+- Fixed bug #34884 (Possible crash in ext/sqlite when sqlite.assoc_case is 
+  being used). (Tony,Ilia)
 
 14 Oct 2005, PHP 5.1 Release Candidate 2
 - Changed SQLite extension to be a shared module in Windows distribution.

diff --git a/ext/sqlite/sqlite.c b/ext/sqlite/sqlite.c
index cc9fc6f0be2fc93e620a21ff899e8e3a20a86ef2..68574ef3eda2f540717f09bb0542b23d33ed31c6 100644 (file)
--- a/ext/sqlite/sqlite.c
+++ b/ext/sqlite/sqlite.c
@@ -1440,14 +1440,13 @@ next_row:
                /* first row - lets copy the column names */
                rres->col_names = safe_emalloc(rres->ncolumns, sizeof(char *), 0);
                for (i = 0; i < rres->ncolumns; i++) {
-                       colname = (char*)colnames[i];
+                       rres->col_names[i] = estrdup((char*)colnames[i]);
 
                        if (SQLITE_G(assoc_case) == 1) {
-                               php_sqlite_strtoupper(colname);
+                               php_sqlite_strtoupper(rres->col_names[i]);
                        } else if (SQLITE_G(assoc_case) == 2) {
-                               php_sqlite_strtolower(colname);
+                               php_sqlite_strtolower(rres->col_names[i]);
                        }
-                       rres->col_names[i] = estrdup(colname);
                }
                if (!rres->buffered) {
                        /* non buffered mode - also fetch memory for on single row */
@@ -1686,16 +1685,17 @@ PHP_FUNCTION(sqlite_fetch_column_types)
        array_init(return_value);
 
        for (i = 0; i < ncols; i++) {
-               char *colname = (char *)colnames[i];
+               if (result_type == PHPSQLITE_ASSOC) {
+                       char *colname = estrdup((char *)colnames[i]);
 
-               if (SQLITE_G(assoc_case) == 1) {
-                       php_sqlite_strtoupper(colname);
-               } else if (SQLITE_G(assoc_case) == 2) {
-                       php_sqlite_strtolower(colname);
-               }
+                       if (SQLITE_G(assoc_case) == 1) {
+                               php_sqlite_strtoupper(colname);
+                       } else if (SQLITE_G(assoc_case) == 2) {
+                               php_sqlite_strtolower(colname);
+                       }
 
-               if (result_type == PHPSQLITE_ASSOC) {
                        add_assoc_string(return_value, colname, colnames[ncols + i] ? (char *)colnames[ncols + i] : "", 1);
+                       efree(colname);
                }
                if (result_type == PHPSQLITE_NUM) {
                        add_index_string(return_value, i, colnames[ncols + i] ? (char *)colnames[ncols + i] : "", 1);