Merge branch 'PHP-7.2'

weltling · weltling · commit a1a33615525f · 2018-03-12T21:03:36.000+01:00
* PHP-7.2:
  Fix heap use after free
diff --git a/ext/pdo_pgsql/pgsql_statement.c b/ext/pdo_pgsql/pgsql_statement.c
@@ -618,11 +618,13 @@ static zend_always_inline char * pdo_pgsql_translate_oid_to_table(Oid oid, PGcon
 	}
 	efree(querystr);
 
-	if ((table_name = PQgetvalue(tmp_res, 0, 0)) == NULL) {
+	if (1 == PQgetisnull(tmp_res, 0, 0) || (table_name = PQgetvalue(tmp_res, 0, 0)) == NULL) {
 		PQclear(tmp_res);
 		return 0;
 	}
 
+	table_name = estrdup(table_name);
+
 	PQclear(tmp_res);
 	return table_name;
 }
@@ -652,6 +654,7 @@ static int pgsql_stmt_get_column_meta(pdo_stmt_t *stmt, zend_long colno, zval *r
 	table_name = pdo_pgsql_translate_oid_to_table(table_oid, S->H->server);
 	if (table_name) {
 		add_assoc_string(return_value, "table", table_name);
+		efree(table_name);
 	}
 
 	switch (S->cols[colno].pgsql_type) {

Original file line number	Diff line number	Diff line change
`@@ -618,11 +618,13 @@ static zend_always_inline char * pdo_pgsql_translate_oid_to_table(Oid oid, PGcon`
`618`	`618`	`}`
`619`	`619`	`efree(querystr);`
`620`	`620`
`621`		`- if ((table_name = PQgetvalue(tmp_res, 0, 0)) == NULL) {`
	`621`	`+ if (1 == PQgetisnull(tmp_res, 0, 0) \|\| (table_name = PQgetvalue(tmp_res, 0, 0)) == NULL) {`
`622`	`622`	`PQclear(tmp_res);`
`623`	`623`	`return 0;`
`624`	`624`	`}`
`625`	`625`
	`626`	`+ table_name = estrdup(table_name);`
	`627`	`+`
`626`	`628`	`PQclear(tmp_res);`
`627`	`629`	`return table_name;`
`628`	`630`	`}`
`@@ -652,6 +654,7 @@ static int pgsql_stmt_get_column_meta(pdo_stmt_t stmt, zend_long colno, zval r`
`652`	`654`	`table_name = pdo_pgsql_translate_oid_to_table(table_oid, S->H->server);`
`653`	`655`	`if (table_name) {`
`654`	`656`	`add_assoc_string(return_value, "table", table_name);`
	`657`	`+ efree(table_name);`
`655`	`658`	`}`
`656`	`659`
`657`	`660`	`switch (S->cols[colno].pgsql_type) {`