From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 15 Nov 2011 18:02:58 +0000 (+0000)
Subject: Fixed bug #60244 (pg_fetch_* functions do not validate that row param is >0).
X-Git-Tag: php-5.3.9RC2~49
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b6530d8978aab57eebd17f6076035f786ae1693b;p=php

Fixed bug #60244 (pg_fetch_* functions do not validate that row param is >0).
---

diff --git a/NEWS b/NEWS
index 8216fb7d80..350ede9965 100644
--- a/NEWS
+++ b/NEWS
@@ -29,6 +29,10 @@ PHP                                                                        NEWS
 - Phar:
   . Fixed bug #60261 (NULL pointer dereference in phar). (Felipe)
 
+- Postgres:
+  . Fixed bug #60244 (pg_fetch_* functions do not validate that row param 
+    is >0). (Ilia)
+
 - SOAP
   . Fixed bug #44686 (SOAP-ERROR: Parsing WSDL with references). (Dmitry)
   
@@ -83,6 +87,10 @@ PHP                                                                        NEWS
   . Fixed bug #48476 (cloning extended DateTime class without calling
     parent::__constr crashed PHP). (Hannes)
 
+- Json:
+  . Fixed bug #55543 (json_encode() with JSON_NUMERIC_CHECK fails on objects
+    with numeric string properties). (Ilia, dchurch at sciencelogic dot com)
+
 - MySQL:
   . Fixed bug #55550 (mysql.trace_mode miscounts result sets). (Johannes)
 
diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index e01816cc5b..336b980142 100644
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -2452,6 +2452,10 @@ static void php_pgsql_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, long result_type,
 	} else {
 		convert_to_long(zrow);
 		row = Z_LVAL_P(zrow);
+		if (row < 0) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "The row parameter must be greater or equal to zero");
+			RETURN_FALSE;
+		}
 	}
 	use_row = ZEND_NUM_ARGS() > 1 && row != -1;
 
@@ -4798,10 +4802,24 @@ PHP_FUNCTION(pg_get_notify)
 	if (result_type & PGSQL_NUM) {
 		add_index_string(return_value, 0, pgsql_notify->relname, 1);
 		add_index_long(return_value, 1, pgsql_notify->be_pid);
+#if HAVE_PQPROTOCOLVERSION && HAVE_PQPARAMETERSTATUS 
+		if (PQprotocolVersion(pgsql) >= 3 && atof(PQparameterStatus(pgsql, "server_version")) >= 9.0) {
+#else 
+		if (atof(PG_VERSION) >= 9.0) {
+#endif 
+			add_index_string(return_value, 2, pgsql_notify->extra, 1);
+		}
 	}
 	if (result_type & PGSQL_ASSOC) {
 		add_assoc_string(return_value, "message", pgsql_notify->relname, 1);
 		add_assoc_long(return_value, "pid", pgsql_notify->be_pid);
+#if HAVE_PQPROTOCOLVERSION && HAVE_PQPARAMETERSTATUS 
+		if (PQprotocolVersion(pgsql) >= 3 && atof(PQparameterStatus(pgsql, "server_version")) >= 9.0) {
+#else 
+		if (atof(PG_VERSION) >= 9.0) {
+#endif 
+			add_assoc_string(return_value, "payload", pgsql_notify->extra, 1);
+		}
 	}
 	PQfreemem(pgsql_notify);
 }
diff --git a/ext/pgsql/tests/bug60244.phpt b/ext/pgsql/tests/bug60244.phpt
new file mode 100644
index 0000000000..94568b6031
--- /dev/null
+++ b/ext/pgsql/tests/bug60244.phpt
@@ -0,0 +1,57 @@
+--TEST--
+Bug #60244 (pg_fetch_* functions do not validate that row param is >0)
+--SKIPIF--
+<?php
+include("skipif.inc");
+?>
+--FILE--
+<?php
+
+include 'config.inc';
+
+$db = pg_connect($conn_str);
+$result = pg_query("select 'a' union select 'b'");
+
+var_dump(pg_fetch_array($result, -1));
+var_dump(pg_fetch_assoc($result, -1));
+var_dump(pg_fetch_object($result, -1));
+var_dump(pg_fetch_row($result, -1));
+
+var_dump(pg_fetch_array($result, 0));
+var_dump(pg_fetch_assoc($result, 0));
+var_dump(pg_fetch_object($result, 0));
+var_dump(pg_fetch_row($result, 0));
+
+pg_close($db);
+
+?>
+--EXPECTF--
+Warning: pg_fetch_array(): The row parameter must be greater or equal to zero in %sbug60244.php on line %d
+bool(false)
+
+Warning: pg_fetch_assoc(): The row parameter must be greater or equal to zero in %sbug60244.php on line %d
+bool(false)
+
+Warning: pg_fetch_object(): The row parameter must be greater or equal to zero in %sbug60244.php on line %d
+bool(false)
+
+Warning: pg_fetch_row(): The row parameter must be greater or equal to zero in %sbug60244.php on line %d
+bool(false)
+array(2) {
+  [0]=>
+  string(1) "a"
+  ["?column?"]=>
+  string(1) "a"
+}
+array(1) {
+  ["?column?"]=>
+  string(1) "a"
+}
+object(stdClass)#1 (1) {
+  ["?column?"]=>
+  string(1) "a"
+}
+array(1) {
+  [0]=>
+  string(1) "a"
+}