Bug #71943 [NEW]: dblib_handle_quoter needs to allocate an extra byte

From: adam dot baratz at gmail dot com Operating system: Linux PHP version: 7.0.5 Package: PDO DBlib Bug Type: Bug Bug description:dblib_handle_quoter needs to allocate an extra byte Description: ------------ The provided test produces the correct results, but a leak is detected when run with valgrind: ==25754== Invalid write of size 1 ==25754== at 0xF16C0F8: dblib_handle_quoter (dblib_driver.c:198) ==25754== by 0x792AD4: zim_PDO_quote (pdo_dbh.c:1149) ==25754== by 0xA8EF54: ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1222) ==25754== by 0xA8D20F: execute_ex (zend_vm_execute.h:424) ==25754== by 0xA8D324: zend_execute (zend_vm_execute.h:468) ==25754== by 0xA30E11: zend_execute_scripts (zend.c:1427) ==25754== by 0x9A26A5: php_execute_script (main.c:2494) ==25754== by 0xB0AE82: do_cli (php_cli.c:982) ==25754== by 0xB0BE30: main (php_cli.c:1352) ==25754== Address 0xf73a7b3 is 0 bytes after a block of size 3 alloc'd ==25754== at 0x4C28C20: malloc (vg_replace_malloc.c:296) ==25754== by 0x9FC76B: _emalloc (zend_alloc.c:2446) ==25754== by 0xF16C056: dblib_handle_quoter (dblib_driver.c:184) ==25754== by 0x792AD4: zim_PDO_quote (pdo_dbh.c:1149) ==25754== by 0xA8EF54: ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1222) ==25754== by 0xA8D20F: execute_ex (zend_vm_execute.h:424) ==25754== by 0xA8D324: zend_execute (zend_vm_execute.h:468) ==25754== by 0xA30E11: zend_execute_scripts (zend.c:1427) ==25754== by 0x9A26A5: php_execute_script (main.c:2494) ==25754== by 0xB0AE82: do_cli (php_cli.c:982) ==25754== by 0xB0BE30: main (php_cli.c:1352) ==25754== Test script: --------------- --TEST-- PDO_DBLIB: Ensure quote function returns expected results --SKIPIF-- <?php if (!extension_loaded('pdo_dblib')) die('skip not loaded'); require dirname(__FILE__) . '/config.inc'; ?> --FILE-- <?php require dirname(__FILE__) . '/config.inc'; var_dump($db->quote(true, PDO::PARAM_BOOL)); var_dump($db->quote(false, PDO::PARAM_BOOL)); var_dump($db->quote(42, PDO::PARAM_INT)); var_dump($db->quote(null, PDO::PARAM_NULL)); var_dump($db->quote('\'', PDO::PARAM_STR)); var_dump($db->quote('foo', PDO::PARAM_STR)); ?> --EXPECT-- string(3) "'1'" string(2) "''" string(4) "'42'" string(2) "''" string(4) "''''" string(5) "'foo'" -- Edit bug report at https://bugs.php.net/bug.php?id=71943&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71943&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71943&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71943&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71943&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71943&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71943&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71943&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71943&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71943&r=support Expected behavior: https://bugs.php.net/fix.php?id=71943&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71943&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71943&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71943&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71943&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71943&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71943&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71943&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71943&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71943&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71943&r=mysqlcfg