clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-21 18:07:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix #76449: SIGSEGV in firebird_handle_doer

Browse Source 
We need to verify that the `result_size` is not larger than our buffer,
and also should make sure that the `len` which is passed to
`isc_vax_integer()` has a permissible value; otherwise we bail out.
This commit is contained in:
Christoph M. Becker 2021-04-30 13:53:21 +02:00 committed by Stanislav Malyshev
parent bcbf8aa0c9
commit 08da7c7372
No known key found for this signature in database
GPG Key ID: 94B3CB48C3ECA219
3 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ext/pdo_firebird/firebird_driver.c
View File

@ -206,8 +206,17 @@ static zend_long firebird_handle_doer(pdo_dbh_t *dbh, const char *sql, size_t sq
if (result[0] == isc_info_sql_records) {
unsigned i = 3, result_size = isc_vax_integer(&result[1],2);
if (result_size > sizeof(result)) {
ret = -1;
goto free_statement;
}
while (result[i] != isc_info_end && i < result_size) {
short len = (short)isc_vax_integer(&result[i+1],2);
/* bail out on bad len */
if (len != 1 && len != 2 && len != 4) {
ret = -1;
goto free_statement;
}
if (result[i] != isc_info_req_select_count) {
ret += isc_vax_integer(&result[i+3],len);
}

BIN
ext/pdo_firebird/tests/bug_76449.data Normal file
View File

Binary file not shown.

23
ext/pdo_firebird/tests/bug_76449.phpt Normal file
View File

@ -0,0 +1,23 @@
--TEST--
Bug #76449 (SIGSEGV in firebird_handle_doer)
--SKIPIF--
<?php
if (!extension_loaded('pdo_firebird')) die("skip pdo_firebird extension not available");
if (!extension_loaded('sockets')) die("skip sockets extension not available");
?>
--FILE--
<?php
require_once "payload_server.inc";
$address = run_server(__DIR__ . "/bug_76449.data");
// no need to change the credentials; we're running against a fake server
$dsn = "firebird:dbname=inet://$address/test";
$username = 'SYSDBA';
$password = 'masterkey';
$dbh = new PDO($dsn, $username, $password, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
var_dump($dbh->exec("INSERT INTO test VALUES ('hihi2', 'xxxxx')"));
?>
--EXPECT--
bool(false)