From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 23 Jun 2003 19:30:42 +0000 (+0000)
Subject: Fixed a crash inside sqlite_array_query() when invalid query
X-Git-Tag: php-4.3.3RC2~259
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=43b0c8adea423292054cbba4703587ff1465e753;p=php

Fixed a crash inside sqlite_array_query() when invalid query
is specified.
---

diff --git a/ext/sqlite/sqlite.c b/ext/sqlite/sqlite.c
index fdc8abf909..fcfded8899 100644
--- a/ext/sqlite/sqlite.c
+++ b/ext/sqlite/sqlite.c
@@ -972,8 +972,11 @@ void sqlite_query(struct php_sqlite_db *db, char *sql, long sql_len, int mode, i
 	if (ret != SQLITE_OK) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s", errtext);
 		sqlite_freemem(errtext);
-		
-		RETURN_FALSE;
+		if (return_value) {
+			RETURN_FALSE;
+		} else {
+			return;
+		}
 	}
 
 	if (!rres) {
@@ -987,7 +990,11 @@ void sqlite_query(struct php_sqlite_db *db, char *sql, long sql_len, int mode, i
 	/* now the result set is ready for stepping: get first row */
 	if (php_sqlite_fetch(rres TSRMLS_CC) != SQLITE_OK) {
 		real_result_dtor(rres TSRMLS_CC);
-		RETURN_FALSE;
+		if (return_value) {
+			RETURN_FALSE;
+		} else {
+			return;	
+		}
 	}
 	
 	rres->curr_row = 0;
@@ -1276,6 +1283,10 @@ PHP_FUNCTION(sqlite_array_query)
 
 	rres = (struct php_sqlite_result *)emalloc(sizeof(*rres));
 	sqlite_query(db, sql, sql_len, mode, 0, NULL, rres TSRMLS_CC);
+	if (db->last_err_code != SQLITE_OK) {
+		efree(rres);
+		RETURN_FALSE;
+	}
 
 	array_init(return_value);
 
diff --git a/ext/sqlite/tests/sqlite_018.phpt b/ext/sqlite/tests/sqlite_018.phpt
new file mode 100755
index 0000000000..bc14bb1c8d
--- /dev/null
+++ b/ext/sqlite/tests/sqlite_018.phpt
@@ -0,0 +1,13 @@
+--TEST--
+sqlite: crash on bad queries inside sqlite_array_query()
+--SKIPIF--
+<?php # vim:ft=php
+if (!extension_loaded("sqlite")) print "skip"; ?>
+--FILE--
+<?php
+include "blankdb.inc";
+
+sqlite_array_query($db, "SELECT foo FROM foobar");
+?>
+--EXPECTF--
+Warning: sqlite_array_query(): no such table: foobar in %s on line %d