archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-9032: SQLite3 authorizer crashes on NULL values

Browse source 
The arguments 3 to 6 of the authorizer callback may be `NULL`[1], and
we have to properly deal with that.  Instead of causing a segfault, we
deny authorization, which is still better than a crash, and apparently,
we cannot do better anyway.

[1] <https://www.sqlite.org/c3ref/set_authorizer.html>

Closes GH-9040.
This commit is contained in:
Christoph M. Becker 2022-07-18 17:33:34 +02:00
parent a442e29485
commit 8ed21a89f3
No known key found for this signature in database
GPG key ID: D66C9593118BCCB6
5 changed files with 68 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
ext/sqlite3/sqlite3.c
View file

@ -2049,6 +2049,9 @@ static int php_sqlite3_authorizer(void *autharg, int action, const char *arg1, c
/* Check open_basedir restrictions first */
if (PG(open_basedir) && *PG(open_basedir)) {
if (action == SQLITE_ATTACH) {
if (!arg1) {
return SQLITE_DENY;
}
if (memcmp(arg1, ":memory:", sizeof(":memory:")) && *arg1) {
if (strncmp(arg1, "file:", 5) == 0) {
/* starts with "file:" */