Skip to content

Commit e92ebce

Browse files
committed
Fixed possible crash in php_mssql_get_column_content_without_type()
# Also fix NEWS entry in PHP_5_2 for previous commit
1 parent c2c3467 commit e92ebce

File tree

2 files changed

+10
-0
lines changed

2 files changed

+10
-0
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
(Kalle)
1212
- Changed the $context parameter on copy() to actually have an effect. (Kalle)
1313

14+
- Fixed possible crash in php_mssql_get_column_content_without_type(). (Kalle)
15+
1416
- Fixed bug #52636 (php_mysql_fetch_hash writes long value into int).
1517
(Kalle, rein at basefarm dot no)
1618
- Fixed bug #52613 (crash in mysqlnd after hitting memory limit). (Andrey)

ext/mssql/php_mssql.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1059,6 +1059,14 @@ static void php_mssql_get_column_content_without_type(mssql_link *mssql_ptr,int
10591059
unsigned char *res_buf;
10601060
int res_length = dbdatlen(mssql_ptr->link, offset);
10611061

1062+
if (res_length == 0) {
1063+
ZVAL_NULL(result);
1064+
return;
1065+
} else if (res_length < 0) {
1066+
ZVAL_FALSE(result);
1067+
return;
1068+
}
1069+
10621070
res_buf = (unsigned char *) emalloc(res_length+1);
10631071
bin = ((DBBINARY *)dbdata(mssql_ptr->link, offset));
10641072
res_buf[res_length] = '\0';

0 commit comments

Comments
 (0)