Skip to content

Commit e16df98

Browse files
dixyesdevnexen
authored andcommitted
ext/pdo_pgsql: Fix _pdo_pgsql_trim_message bad access
close GH-19239
1 parent 5dd9651 commit e16df98

File tree

2 files changed

+11
-1
lines changed

2 files changed

+11
-1
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ PHP NEWS
2727
return value check). (nielsdos, botovq)
2828
. Fix error return check of EVP_CIPHER_CTX_ctrl(). (nielsdos)
2929

30+
- PDO Pgsql:
31+
. Fixed dangling pointer access on _pdo_pgsql_trim_message helper.
32+
(dixyes)
33+
3034
- SOAP:
3135
. Fixed bug GH-18640 (heap-use-after-free ext/soap/php_encoding.c:299:32
3236
in soap_check_zval_ref). (nielsdos)

ext/pdo_pgsql/pgsql_driver.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,14 @@ static bool pgsql_handle_in_transaction(pdo_dbh_t *dbh);
3838

3939
static char * _pdo_pgsql_trim_message(const char *message, int persistent)
4040
{
41-
size_t i = strlen(message)-1;
41+
size_t i = strlen(message);
4242
char *tmp;
43+
if (UNEXPECTED(i == 0)) {
44+
tmp = pemalloc(1, persistent);
45+
tmp[0] = '\0';
46+
return tmp;
47+
}
48+
--i;
4349

4450
if (i>1 && (message[i-1] == '\r' || message[i-1] == '\n') && message[i] == '.') {
4551
--i;

0 commit comments

Comments
 (0)