Bug #68673 [Opn->Nab]: out of bounds access

Edit report at https://bugs.php.net/bug.php?id=68673&edit=1 ID: 68673 Updated by: cmb@php.net Reported by: bugreports at internot dot info Summary: out of bounds access -Status: Open +Status: Not a bug Type: Bug Package: SQLite related Operating System: Linux Ubuntu 14.04 PHP Version: master-Git-2014-12-28 (Git) -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: I had a look at the bundled sqlite3.c from 2014-12-28[1], and there the mentioned aiCol is an int* (not an int), and &rowId is an sqlite3_value** (not an int). [1] <https://github.com/php/php-src/blob/fccd1eda5fe440105d051f4cbaa77ced95b674f0/ext/sqlite3/libsqlite/sqlite3.c> Previous Comments: ------------------------------------------------------------------------ [2014-12-28 23:26:07] bugreports at internot dot info And here: 140572 rc = fts3SqlStmt(p, SQL_SELECT_CONTENT_BY_ROWID, &pSelect, &pRowid); &pRowid is an int, but is called as an array in the fts3SqlStmt function: 139924 rc = sqlite3_bind_value(pStmt, i+1, apVal[i]); Thanks, ------------------------------------------------------------------------ [2014-12-28 23:20:49] bugreports at internot dot info Description: ------------ Hi, In /ext/sqlite3/libsqlite/sqlite3.c: 96895 fkLookupParent(pParse, iDb, pTo, pIdx, pFKey, aiCol, regOld, -1,isIgnore); aiCol is an int, but it is used as an array: 96302 int iReg = aiCol[i] + regData + 1; in the fkLookupParent() function. Thanks, ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68673&edit=1