MFH: Fixed bug #34884 (Possible crash in ext/sqlite when sqlite.assoc_case

is being used).

NEWS

@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Oct 2005, PHP 5.1 Release Candidate 3
 - Fixed bug #34873 (Segmentation Fault on foreach in object). (Dmitry)
+- Fixed bug #34884 (Possible crash in ext/sqlite when sqlite.assoc_case is 
+  being used). (Tony,Ilia)
 
 14 Oct 2005, PHP 5.1 Release Candidate 2
 - Changed SQLite extension to be a shared module in Windows distribution.

ext/sqlite/sqlite.c

@@ -1440,14 +1440,13 @@ next_row:
 		/* first row - lets copy the column names */
 		rres->col_names = safe_emalloc(rres->ncolumns, sizeof(char *), 0);
 		for (i = 0; i < rres->ncolumns; i++) {
-			colname = (char*)colnames[i];
+			rres->col_names[i] = estrdup((char*)colnames[i]);
 
 			if (SQLITE_G(assoc_case) == 1) {
-				php_sqlite_strtoupper(colname);
+				php_sqlite_strtoupper(rres->col_names[i]);
 			} else if (SQLITE_G(assoc_case) == 2) {
-				php_sqlite_strtolower(colname);
+				php_sqlite_strtolower(rres->col_names[i]);
 			}
-			rres->col_names[i] = estrdup(colname);
 		}
 		if (!rres->buffered) {
 			/* non buffered mode - also fetch memory for on single row */
@@ -1686,16 +1685,17 @@ PHP_FUNCTION(sqlite_fetch_column_types)
 	array_init(return_value);
 
 	for (i = 0; i < ncols; i++) {
-		char *colname = (char *)colnames[i];
+		if (result_type == PHPSQLITE_ASSOC) {
+			char *colname = estrdup((char *)colnames[i]);
 
-		if (SQLITE_G(assoc_case) == 1) {
-			php_sqlite_strtoupper(colname);
-		} else if (SQLITE_G(assoc_case) == 2) {
-			php_sqlite_strtolower(colname);
-		}
+			if (SQLITE_G(assoc_case) == 1) {
+				php_sqlite_strtoupper(colname);
+			} else if (SQLITE_G(assoc_case) == 2) {
+				php_sqlite_strtolower(colname);
+			}
 
-		if (result_type == PHPSQLITE_ASSOC) {
 			add_assoc_string(return_value, colname, colnames[ncols + i] ? (char *)colnames[ncols + i] : "", 1);
+			efree(colname);
 		}
 		if (result_type == PHPSQLITE_NUM) {
 			add_index_string(return_value, i, colnames[ncols + i] ? (char *)colnames[ncols + i] : "", 1);