Bug #68673 [Com]: out of bounds access
| From: | bugreports at internot dot info | Date: | Sun, 28 Dec 2014 23:26:08 +0000 |
| Subject: | Bug #68673 [Com]: out of bounds access | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-189278@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=68673&edit=1
ID: 68673
Comment by: bugreports at internot dot info
Reported by: bugreports at internot dot info
Summary: out of bounds access
Status: Open
Type: Bug
Package: *General Issues
Operating System: Linux Ubuntu 14.04
PHP Version: master-Git-2014-12-28 (Git)
Block user comment: N
Private report: N
New Comment:
And here:
140572 rc = fts3SqlStmt(p, SQL_SELECT_CONTENT_BY_ROWID, &pSelect, &pRowid);
&pRowid is an int, but is called as an array in the fts3SqlStmt function:
139924 rc = sqlite3_bind_value(pStmt, i+1, apVal[i]);
Thanks,
Previous Comments:
------------------------------------------------------------------------
[2014-12-28 23:20:49] bugreports at internot dot info
Description:
------------
Hi,
In /ext/sqlite3/libsqlite/sqlite3.c:
96895 fkLookupParent(pParse, iDb, pTo, pIdx, pFKey, aiCol, regOld, -1,isIgnore);
aiCol is an int, but it is used as an array:
96302 int iReg = aiCol[i] + regData + 1;
in the fkLookupParent() function.
Thanks,
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68673&edit=1