cvs: php-src(PHP_5_1) / NEWS /ext/dbase dbf_head.c

tony2001 Mon Jan 23 22:42:12 2006 UTC Modified files: (Branch: PHP_5_1) /php-src/ext/dbase dbf_head.c /php-src NEWS Log: MFH: fix #36113 (Reading records of unsupported type causes segfault) http://cvs.php.net/viewcvs.cgi/php-src/ext/dbase/dbf_head.c?r1=1.14&r2=1.14.4.1&diff_format=u Index: php-src/ext/dbase/dbf_head.c diff -u php-src/ext/dbase/dbf_head.c:1.14 php-src/ext/dbase/dbf_head.c:1.14.4.1 --- php-src/ext/dbase/dbf_head.c:1.14 Sun Oct 12 01:07:59 2003 +++ php-src/ext/dbase/dbf_head.c Mon Jan 23 22:42:12 2006 @@ -24,7 +24,7 @@ dbfield_t *dbf, *cur_f, *tdbf; int ret, nfields, offset, gf_retval; - if ((dbh = (dbhead_t *)malloc(sizeof(dbhead_t))) == NULL) + if ((dbh = (dbhead_t *)calloc(1, sizeof(dbhead_t))) == NULL) return NULL; if (lseek(fd, 0, 0) < 0) return NULL; @@ -44,7 +44,7 @@ /* malloc enough memory for the maximum number of fields: 32 * 1024 = 32K dBase5 (for Win) seems to allow that many */ - tdbf = (dbfield_t *)malloc(sizeof(dbfield_t)*1024); + tdbf = (dbfield_t *)calloc(1, sizeof(dbfield_t)*1024); offset = 1; nfields = 0; @@ -157,7 +157,8 @@ } if ((dbf->db_format = get_dbf_f_fmt(dbf)) == NULL) { - return 1; + /* something went wrong, most likely this fieldtype is not supported */ + return -1; } return 0; @@ -235,6 +236,8 @@ case 'M': strcpy(format, "%s"); break; + default: + return NULL; } return (char *)strdup(format); } @@ -256,7 +259,7 @@ } } - if ((dbh = get_dbf_head(fd)) == 0) { + if ((dbh = get_dbf_head(fd)) == NULL) { fprintf(stderr, "Unable to get header\n"); return NULL; } http://cvs.php.net/viewcvs.cgi/php-src/NEWS?r1=1.2027.2.373&r2=1.2027.2.374&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.373 php-src/NEWS:1.2027.2.374 --- php-src/NEWS:1.2027.2.373 Mon Jan 23 15:24:10 2006 +++ php-src/NEWS Mon Jan 23 22:42:12 2006 @@ -11,6 +11,8 @@ on error. (Pierre) - Fixed bug #36134 (DirectoryIterator constructor failed to detect empty directory names). (Ilia) +- Fixed bug #36113 (Reading records of unsupported type causes segfault). + (Tony) - Fixed bug #36096 (oci_result() returns garbage after oci_fetch() failed). (Tony) - Fixed bug #36071 (Engine Crash related with 'clone'). (Dmitry)