com php-src: Fix bug #66550 (SQLite prepared statement use-after-free): ext/sqlite3/sqlite3.c ext/sqlite3/tests/bug66550.phpt

Commit: bef6df6a7eedc659a7ddfbad1eb457c193ed6bb8 Author: Stanislav Malyshev <stas@php.net> Sun, 5 Apr 2015 22:27:02 -0700 Committer: Ferenc Kovacs <tyrael@php.net> Wed, 15 Apr 2015 19:32:57 +0200 Parents: c3771929b7376f454082603e0ed9d0a9a463518d Branches: PHP-5.6.8 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=bef6df6a7eedc659a7ddfbad1eb457c193ed6bb8 Log: Fix bug #66550 (SQLite prepared statement use-after-free) Bugs: https://bugs.php.net/66550 Changed paths: M ext/sqlite3/sqlite3.c A ext/sqlite3/tests/bug66550.phpt Diff: diff --git a/ext/sqlite3/sqlite3.c b/ext/sqlite3/sqlite3.c index bec51cc..58ab5e8 100644 --- a/ext/sqlite3/sqlite3.c +++ b/ext/sqlite3/sqlite3.c @@ -1287,6 +1287,8 @@ PHP_METHOD(sqlite3stmt, paramCount) php_sqlite3_stmt *stmt_obj; zval *object = getThis(); stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC); + + SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3) if (zend_parse_parameters_none() == FAILURE) { return; @@ -1305,6 +1307,8 @@ PHP_METHOD(sqlite3stmt, close) php_sqlite3_stmt *stmt_obj; zval *object = getThis(); stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC); + + SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3) if (zend_parse_parameters_none() == FAILURE) { return; @@ -1325,6 +1329,8 @@ PHP_METHOD(sqlite3stmt, reset) php_sqlite3_stmt *stmt_obj; zval *object = getThis(); stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC); + + SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3) if (zend_parse_parameters_none() == FAILURE) { return; @@ -1347,6 +1353,8 @@ PHP_METHOD(sqlite3stmt, clear) php_sqlite3_stmt *stmt_obj; zval *object = getThis(); stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC); + + SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3) if (zend_parse_parameters_none() == FAILURE) { return; @@ -1370,6 +1378,8 @@ PHP_METHOD(sqlite3stmt, readOnly) php_sqlite3_stmt *stmt_obj; zval *object = getThis(); stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC); + + SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3) if (zend_parse_parameters_none() == FAILURE) { return; @@ -1439,6 +1449,8 @@ PHP_METHOD(sqlite3stmt, bindParam) zval *object = getThis(); struct php_sqlite3_bound_param param = {0}; stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC); + + SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3) param.param_number = -1; param.type = SQLITE3_TEXT; @@ -1472,6 +1484,8 @@ PHP_METHOD(sqlite3stmt, bindValue) zval *object = getThis(); struct php_sqlite3_bound_param param = {0}; stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC); + + SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3) param.param_number = -1; param.type = SQLITE3_TEXT; @@ -1509,6 +1523,8 @@ PHP_METHOD(sqlite3stmt, execute) stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC); + SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3) + if (zend_parse_parameters_none() == FAILURE) { return; } diff --git a/ext/sqlite3/tests/bug66550.phpt b/ext/sqlite3/tests/bug66550.phpt new file mode 100644 index 0000000..a44515b --- /dev/null +++ b/ext/sqlite3/tests/bug66550.phpt @@ -0,0 +1,23 @@ +--TEST-- +Bug #66550 (SQLite prepared statement use-after-free) +--SKIPIF-- +<?php +if (!extension_loaded('sqlite3')) die('skip'); +?> +--FILE-- +<?php + +$db = new SQLite3(':memory:'); + +$db->exec('CREATE TABLE foo (id INTEGER, bar STRING)'); + +$stmt = $db->prepare('SELECT bar FROM foo WHERE id=:id'); +// Close the database connection and free the internal sqlite3_stmt object +$db->close(); +// Access the sqlite3_stmt object via the php_sqlite3_stmt container +$stmt->reset(); +?> +==DONE== +--EXPECTF-- +Warning: SQLite3Stmt::reset(): The SQLite3 object has not been correctly initialised in %s +==DONE==