MFH: Fixed possible crash inside pg_copy_(to|from) function if delimiter is

more then 1 character long.

diff --git a/NEWS b/NEWS
index 040bd363ce1e8341ea26f28b7e24c07f6c2d97c7..16c049d82e92a60d142a543ae58dced4105110af 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, Version 4.3.7
+- Fixed possible crash inside pg_copy_(to|from) function if delimiter is more
+  then 1 character long. (Ilia)
 - Fixed handling of return values from storred procedures in mssql_execute()
   with multiple result sets returned. (Frank)
 - Fixed bug #28055 (timeout duration too long in feof()/pfsockopen() liveness

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 06cfe78172a5d5e2066b7c349735d92e01f027e7..7739347539441e6b7de5245a1065a9e6fc76fe00 100644 (file)
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -2515,8 +2515,8 @@ PHP_FUNCTION(pg_copy_to)
        ZEND_FETCH_RESOURCE2(pgsql, PGconn *, &pgsql_link, id, "PostgreSQL link", le_link, le_plink);
 
        query = (char *)emalloc(strlen(query_template) + strlen(table_name) + strlen(pg_null_as) + 1);
-       sprintf(query, "COPY \"%s\" TO STDOUT DELIMITERS '%s' WITH NULL AS '%s'",
-                       table_name,     pg_delim, pg_null_as);
+       sprintf(query, "COPY \"%s\" TO STDOUT DELIMITERS '%c' WITH NULL AS '%s'",
+                       table_name, *pg_delim, pg_null_as);
 
        while ((pgsql_result = PQgetResult(pgsql))) {
                PQclear(pgsql_result);
@@ -2625,8 +2625,8 @@ PHP_FUNCTION(pg_copy_from)
        ZEND_FETCH_RESOURCE2(pgsql, PGconn *, &pgsql_link, id, "PostgreSQL link", le_link, le_plink);
 
        query = (char *)emalloc(strlen(query_template) + strlen(table_name) + strlen(pg_null_as) + 1);
-       sprintf(query, "COPY \"%s\" FROM STDIN DELIMITERS '%s' WITH NULL AS '%s'",
-                       table_name, pg_delim, pg_null_as);
+       sprintf(query, "COPY \"%s\" FROM STDIN DELIMITERS '%c' WITH NULL AS '%s'",
+                       table_name, *pg_delim, pg_null_as);
        while ((pgsql_result = PQgetResult(pgsql))) {
                PQclear(pgsql_result);
        }