MFH

ext/interbase/interbase.c

@@ -595,19 +595,19 @@ int _php_ibase_attach_db(char **args, int *len, long *largs, isc_db_handle *db T
 
 	for (i = 0; i < sizeof(dpb_args); ++i) {
 		if (dpb_args[i] && args[i] && len[i] && buf_len > 0) {
-			dpb_len += snprintf(dpb, buf_len, "%c%c%s", dpb_args[i],(unsigned char)len[i],args[i]);
+			dpb_len = snprintf(dpb, buf_len, "%c%c%s", dpb_args[i],(unsigned char)len[i],args[i]);
 			dpb += dpb_len;
 			buf_len -= dpb_len;
 		}
 	}
 	if (largs[BUF] && buf_len > 0) {
-		dpb_len += snprintf(dpb, buf_len, "%c\2%c%c", isc_dpb_num_buffers, 
+		dpb_len = snprintf(dpb, buf_len, "%c\2%c%c", isc_dpb_num_buffers, 
 			(char)(largs[BUF] >> 8), (char)(largs[BUF] & 0xff));
 		dpb += dpb_len;
 		buf_len -= dpb_len;
 	}
 	if (largs[SYNC] && buf_len > 0) {
-		dpb_len += sprintf(dpb, buf_len, "%c\1%c", isc_dpb_force_write, largs[SYNC] == isc_spb_prp_wm_sync ? 1 : 0);
+		dpb_len = sprintf(dpb, buf_len, "%c\1%c", isc_dpb_force_write, largs[SYNC] == isc_spb_prp_wm_sync ? 1 : 0);
 		dpb += dpb_len;
 		buf_len -= dpb_len;
 	}

ext/pdo_firebird/firebird_driver.c

@@ -602,6 +602,8 @@ static int pdo_firebird_handle_factory(pdo_dbh_t *dbh, zval *driver_options TSRM
 		{ "role", NULL,	0 }
 	};
 	int i, ret = 0;
+	short buf_len = 256, dpb_len;
+
 	pdo_firebird_db_handle *H = dbh->driver_data = pecalloc(1,sizeof(*H),dbh->is_persistent);
 
 	php_pdo_parse_data_source(dbh->data_source, dbh->data_source_len, vars, 3);
@@ -616,9 +618,11 @@ static int pdo_firebird_handle_factory(pdo_dbh_t *dbh, zval *driver_options TSRM
 		
 		/* loop through all the provided arguments and set dpb fields accordingly */
 		for (i = 0; i < sizeof(dpb_flags); ++i) {
-			if (dpb_values[i]) {
-				dpb += sprintf(dpb, "%c%c%s", dpb_flags[i], (unsigned char)strlen(dpb_values[i]),
+			if (dpb_values[i] && buf_len > 0) {
+				dpb_len = snprintf(dpb, buf_len, "%c%c%s", dpb_flags[i], (unsigned char)strlen(dpb_values[i]),
 					dpb_values[i]);
+				dpb += dpb_len;
+				buf_len -= dpb_len;
 			}
 		}