cvs: php4 /ext/pgsql pgsql.c

iliaa Fri Apr 25 17:59:58 2003 EDT Modified files: /php4/ext/pgsql pgsql.c Log: emalloc -> safe_emalloc Fixed possible buffer overflow in pg_lo_read() Index: php4/ext/pgsql/pgsql.c diff -u php4/ext/pgsql/pgsql.c:1.270 php4/ext/pgsql/pgsql.c:1.271 --- php4/ext/pgsql/pgsql.c:1.270 Thu Apr 17 12:54:43 2003 +++ php4/ext/pgsql/pgsql.c Fri Apr 25 17:59:58 2003 @@ -19,7 +19,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: pgsql.c,v 1.270 2003/04/17 16:54:43 jay Exp $ */ +/* $Id: pgsql.c,v 1.271 2003/04/25 21:59:58 iliaa Exp $ */ #include <stdlib.h> @@ -1968,7 +1968,7 @@ buf_len = Z_LVAL_PP(len); } - buf = (char *) emalloc(sizeof(char)*(buf_len+1)); + buf = (char *) safe_emalloc(sizeof(char), (buf_len+1), 0); if ((nbytes = lo_read((PGconn *)pgsql->conn, pgsql->lofd, buf, buf_len))<0) { efree(buf); RETURN_FALSE; @@ -2622,7 +2622,7 @@ return; } - to = (char *)emalloc(from_len*2+1); + to = (char *)safe_emalloc(from_len, 2, 1); to_len = (int)PQescapeString(to, from, from_len); RETURN_STRINGL(to, to_len, 0); } @@ -3566,7 +3566,7 @@ #if HAVE_PQESCAPE { char *tmp; - tmp = (char *)emalloc(Z_STRLEN_PP(val)*2+1); + tmp = (char *)safe_emalloc(Z_STRLEN_PP(val), 2, 1); Z_STRLEN_P(new_val) = (int)PQescapeString(tmp, Z_STRVAL_PP(val), Z_STRLEN_PP(val)); Z_STRVAL_P(new_val) = tmp; }