Merge branch 'PHP-5.6'

laruence · laruence · commit ca1ba39102d3 · 2015-07-07T21:38:24.000+08:00
Conflicts:
	ext/sqlite3/sqlite3.c
diff --git a/ext/sqlite3/sqlite3.c b/ext/sqlite3/sqlite3.c
@@ -281,7 +281,11 @@ PHP_METHOD(sqlite3, lastErrorCode)
 		return;
 	}
 
-	RETURN_LONG(sqlite3_errcode(db_obj->db));
+	if (db_obj->initialised) {
+		RETURN_LONG(sqlite3_errcode(db_obj->db));
+	} else {
+		RETURN_LONG(0);
+	}
 }
 /* }}} */
 
@@ -299,7 +303,11 @@ PHP_METHOD(sqlite3, lastErrorMsg)
 		return;
 	}
 
-	RETVAL_STRING((char *)sqlite3_errmsg(db_obj->db));
+	if (db_obj->initialised) {
+		RETURN_STRING((char *)sqlite3_errmsg(db_obj->db));
+	} else {
+		RETURN_EMPTY_STRING();
+	}
 }
 /* }}} */
 
diff --git a/ext/sqlite3/tests/bug69972.phpt b/ext/sqlite3/tests/bug69972.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #69972 (Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk())
+--SKIPIF--
+<?php
+if (!extension_loaded('sqlite3')) die('skip');
+?>
+--FILE--
+<?php
+$db = new SQLite3(':memory:');
+echo "SELECTING from invalid table\n";
+$result = $db->query("SELECT * FROM non_existent_table");
+echo "Closing database\n";
+var_dump($db->close());
+echo "Done\n";
+
+// Trigger the use-after-free
+echo "Error Code: " . $db->lastErrorCode() . "\n";
+echo "Error Msg: " . $db->lastErrorMsg() . "\n";
+?>
+--EXPECTF--
+SELECTING from invalid table
+
+Warning: SQLite3::query(): Unable to prepare statement: 1, no such table: non_existent_table in %sbug69972.php on line %d
+Closing database
+bool(true)
+Done
+Error Code: 0
+Error Msg:

Original file line number	Diff line number	Diff line change
`@@ -281,7 +281,11 @@ PHP_METHOD(sqlite3, lastErrorCode)`
`281`	`281`	`return;`
`282`	`282`	`}`
`283`	`283`
`284`		`- RETURN_LONG(sqlite3_errcode(db_obj->db));`
	`284`	`+ if (db_obj->initialised) {`
	`285`	`+ RETURN_LONG(sqlite3_errcode(db_obj->db));`
	`286`	`+ } else {`
	`287`	`+ RETURN_LONG(0);`
	`288`	`+ }`
`285`	`289`	`}`
`286`	`290`	`/* }}} */`
`287`	`291`
`@@ -299,7 +303,11 @@ PHP_METHOD(sqlite3, lastErrorMsg)`
`299`	`303`	`return;`
`300`	`304`	`}`
`301`	`305`
`302`		`- RETVAL_STRING((char *)sqlite3_errmsg(db_obj->db));`
	`306`	`+ if (db_obj->initialised) {`
	`307`	`+ RETURN_STRING((char *)sqlite3_errmsg(db_obj->db));`
	`308`	`+ } else {`
	`309`	`+ RETURN_EMPTY_STRING();`
	`310`	`+ }`
`303`	`311`	`}`
`304`	`312`	`/* }}} */`
`305`	`313`