Skip to content

Commit b82fc3c

Browse files
authored
Fix unchecked sqlite3_column_text() calls (php#22715)
This is the pdo equivalent of phpGH-22045. Notably it does not include a change for the blob call because ZVAL_STRINGL_FAST already takes care of that implicitly.
1 parent 61a987b commit b82fc3c

1 file changed

Lines changed: 14 additions & 4 deletions

File tree

ext/pdo_sqlite/sqlite_statement.c

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -276,8 +276,13 @@ static int pdo_sqlite_stmt_get_col(
276276
int64_t i = sqlite3_column_int64(S->stmt, colno);
277277
#if SIZEOF_ZEND_LONG < 8
278278
if (i > ZEND_LONG_MAX || i < ZEND_LONG_MIN) {
279+
const char *text = (const char *) sqlite3_column_text(S->stmt, colno);
280+
if (UNEXPECTED(!text)) {
281+
pdo_sqlite_error_stmt(stmt);
282+
return 0;
283+
}
279284
ZVAL_STRINGL(result,
280-
(char *) sqlite3_column_text(S->stmt, colno),
285+
text,
281286
sqlite3_column_bytes(S->stmt, colno));
282287
return 1;
283288
}
@@ -295,10 +300,15 @@ static int pdo_sqlite_stmt_get_col(
295300
sqlite3_column_blob(S->stmt, colno), sqlite3_column_bytes(S->stmt, colno));
296301
return 1;
297302

298-
default:
299-
ZVAL_STRINGL_FAST(result,
300-
(char *) sqlite3_column_text(S->stmt, colno), sqlite3_column_bytes(S->stmt, colno));
303+
default: {
304+
const char *text = (const char *) sqlite3_column_text(S->stmt, colno);
305+
if (UNEXPECTED(!text)) {
306+
pdo_sqlite_error_stmt(stmt);
307+
return 0;
308+
}
309+
ZVAL_STRINGL_FAST(result, text, sqlite3_column_bytes(S->stmt, colno));
301310
return 1;
311+
}
302312
}
303313
}
304314

0 commit comments

Comments
 (0)