From: Ilia Alshanetsky <iliaa@php.net>
Date: Thu, 28 Dec 2006 15:21:32 +0000 (+0000)
Subject: MFB: Added buffer length checks
X-Git-Tag: RELEASE_1_0_0RC1~465
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c42fb0033dad7ecfa7513a90d46ac65f331d711c;p=php

MFB: Added buffer length checks
---

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 31ec83cebb..7c69108ce5 100644
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -5472,7 +5472,7 @@ static inline int build_assignment_string(smart_str *querystr, HashTable *ht, co
 				smart_str_append_long(querystr, Z_LVAL_PP(val));
 				break;
 			case IS_DOUBLE:
-				smart_str_appendl(querystr, buf, sprintf(buf, "%f", Z_DVAL_PP(val)));
+				smart_str_appendl(querystr, buf, MIN(snprintf(buf, sizeof(buf), "%f", Z_DVAL_PP(val)), sizeof(buf)-1));
 				break;
 			default:
 				/* should not happen */