Fixed a possible arbitrary memory access inside sqlite extension. Reported by Mateusz Kocielski.

16 years ago · 5fa3f0b849
2 changed files with 4 additions and 2 deletions
--- a/2
+++ b/2
@ -13,6 +13,8 @@ PHP                                                                        NEWS
  requests (Fixes CVE-2010-0397, bug #51288). (Raphael Geissert)
 - Fixed handling of session variable serialization on certain prefix
  characters. Reported by Stefan Esser (Ilia)
+- Fixed a possible arbitrary memory access inside sqlite extension. Reported
+  by Mateusz Kocielski. (Ilia)  

 - Fixed bug #51671 (imagefill does not work correctly for small images).
  (Pierre)
--- a/ext/sqlite/sqlite.c
+++ b/ext/sqlite/sqlite.c
@ -2170,7 +2170,7 @@ PHP_FUNCTION(sqlite_array_query)
 		return;
 	}

-	rres = (struct php_sqlite_result *)emalloc(sizeof(*rres));
+	rres = (struct php_sqlite_result *)ecalloc(1, sizeof(*rres));
 	sqlite_query(NULL, db, sql, sql_len, (int)mode, 0, NULL, &rres, NULL TSRMLS_CC);
 	if (db->last_err_code != SQLITE_OK) {
 		if (rres) {
@ -2286,7 +2286,7 @@ PHP_FUNCTION(sqlite_single_query)
 		return;
 	}

-	rres = (struct php_sqlite_result *)emalloc(sizeof(*rres));
+	rres = (struct php_sqlite_result *)ecalloc(1, sizeof(*rres));
 	sqlite_query(NULL, db, sql, sql_len, PHPSQLITE_NUM, 0, NULL, &rres, NULL TSRMLS_CC);
 	if (db->last_err_code != SQLITE_OK) {
 		if (rres) {