Re: com php-src: Check the return value of dbconvert() in mssql_guid_string(), as it may return -1 in case the conversion failed. In that case false
is returned.: NEWS ext/mssql/php_mssql.c

On Sat, Aug 6, 2016 at 10:17 AM, Kalle Sommer Nielsen <kalle@php.net> wrote: > Commit: 5e2b8349b4ee7df1aa70deb4351f4f0d5c3d8a84 > Author: Kalle Sommer Nielsen <kalle@php.net> Sat, 6 Aug 2016 > 10:17:49 +0200 > Parents: 65056e9d6c74adef89332080b5458fd4850fb3b7 > Branches: PHP-5.6 > > Link: http://git.php.net/?p=php-src.git;a=commitdiff;h= > 5e2b8349b4ee7df1aa70deb4351f4f0d5c3d8a84 > > Log: > Check the return value of dbconvert() in mssql_guid_string(), as it may > return -1 in case the conversion failed. In that case false is returned. > > Also initialize buffer and buffer2 to NULL, which should fix bug #72039 > (Use of uninitialised value on mssql_guid_string). > > This only applies to 5.6, as we do not have mssql in 7.0 anymore > > Bugs: > https://bugs.php.net/72039 > > Changed paths: > M NEWS > M ext/mssql/php_mssql.c > > > Diff: > diff --git a/NEWS b/NEWS > index 8b95572..10f0302 100644 > --- a/NEWS > +++ b/NEWS > @@ -2,6 +2,9 @@ PHP > NEWS > |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| > ||||||||||||||||||| > ?? ??? 2016, PHP 5.6.26 > > +- MSSQL: > + . Fixed bug #72039 (Use of uninitialised value on mssql_guid_string). > (Kalle) > + > 18 Aug 2016, PHP 5.6.25 > > - Core: > diff --git a/ext/mssql/php_mssql.c b/ext/mssql/php_mssql.c > index aa1ea54..20ac190 100644 > --- a/ext/mssql/php_mssql.c > +++ b/ext/mssql/php_mssql.c > @@ -2235,21 +2235,24 @@ PHP_FUNCTION(mssql_guid_string) > char *binary; > int binary_len; > zend_bool sf = 0; > - char buffer[32+1]; > - char buffer2[36+1]; > + char buffer[32+1] = NULL; > Did you mean = {0}? > > if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", > &binary, &binary_len, &sf) == FAILURE) { > return; > } > > - dbconvert(NULL, SQLBINARY, (BYTE*) binary, MIN(16, binary_len), > SQLCHAR, buffer, -1); > + if (dbconvert(NULL, SQLBINARY, (BYTE*) binary, MIN(16, > binary_len), SQLCHAR, buffer, (DBINT) -1) == -1) { > + php_error_docref(NULL TSRMLS_CC, E_WARNING, "could not > convert binary string to GUID string"); > + RETURN_FALSE; > + } > > if (sf) { > php_strtoupper(buffer, 32); > RETURN_STRING(buffer, 1); > - } > - else { > + } else { > int i; > + char buffer2[36+1] = NULL; > + > /* FIXME this works only on little endian machine */ > for (i=0; i<4; i++) { > buffer2[2*i] = buffer[6-2*i]; > > > -- > PHP CVS Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php >