Bug #66071 [Asn->Csd]: memory corruption in error handling / isc_interprete is unsafe

From: Date: Tue, 08 Apr 2014 11:15:07 +0000
Subject: Bug #66071 [Asn->Csd]: memory corruption in error handling / isc_interprete is unsafe
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-185141@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=66071&edit=1

 ID:                 66071
 Updated by:         mariuz@php.net
 Reported by:        slavb18 at gmail dot com
 Summary:            memory corruption in error handling / isc_interprete
                     is unsafe
-Status:             Assigned
+Status:             Closed
 Type:               Bug
 Package:            PDO Firebird
 Operating System:   any
 PHP Version:        5.4.21
 Assigned To:        mariuz
 Block user comment: N
 Private report:     N

 New Comment:

The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

Thank you patch applied to master , please retest it


Previous Comments:
------------------------------------------------------------------------
[2013-11-09 07:02:00] slavb18 at gmail dot com

Description:
------------
isc_interprete is unsafe, it should be replaced with fb_iterpret

Test script:
---------------
CREATE EXCEPTION D_ACCESS_DENIED 'access denied';
create or alter procedure testex2
returns (
    a integer)
as
begin
  exception D_ACCESS_DENIED
'YXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';
  a=1;
  suspend;
end

$q="select * from testex2";
$sth=$pdo->prepare($q);
$sth->execute();
$row=$sth->fetch(PDO::FETCH_ASSOC);
print_r($row);

Expected result:
----------------
 Uncaught exception 'PDOException' with message 'SQLSTATE[HY000]: General error: -836
exception 2 D_ACCESS_DENIED
YXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
' 

Actual result:
--------------
*** stack smashing detected ***: php terminated
======= Backtrace: =========
/lib64/libc.so.6(+0x7410f)[0x7fa80dc6410f]
/lib64/libc.so.6(__fortify_fail+0x37)[0x7fa80dce8657]
/lib64/libc.so.6(__fortify_fail+0x0)[0x7fa80dce8620]
/usr/lib64/php5/extensions/pdo_firebird.so(+0x28ee)[0x7fa807c188ee]
/usr/lib64/php5/extensions/pdo.so(+0xa5be)[0x7fa807e275be]
/usr/lib64/php5/extensions/pdo.so(+0x14855)[0x7fa807e31855]
php(+0x6cdcbc)[0x7fa80f9cecbc]
php(execute+0x1e7)[0x7fa80f939367]
php(zend_execute_scripts+0x182)[0x7fa80f90ff02]
php(php_execute_script+0x1cc)[0x7fa80f8a92cc]
php(+0x6cfd1f)[0x7fa80f9d0d1f]
php(+0x468f33)[0x7fa80f769f33]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fa80dc11be5]
php(+0x468fd1)[0x7fa80f769fd1]



------------------------------------------------------------------------



-- 
Edit this bug report at https://bugs.php.net/bug.php?id=66071&edit=1

Thread (2 messages)

« previous php.bugs (#185141) next »