Skip to content

Commit b4f73be

Browse files
nielsdosremicollet
authored andcommitted
Fix GHSA-5hqh-c84r-qjcv: Integer overflow in the firebird quoter causing OOB writes
(cherry picked from commit 69c5f68fdc3deed9ebce2cc44b4bf5e0c47cd28f)
1 parent 5d9e540 commit b4f73be

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

ext/pdo_firebird/firebird_driver.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -663,7 +663,7 @@ static zend_long firebird_handle_doer(pdo_dbh_t *dbh, const char *sql, size_t sq
663663
static int firebird_handle_quoter(pdo_dbh_t *dbh, const char *unquoted, size_t unquotedlen, /* {{{ */
664664
char **quoted, size_t *quotedlen, enum pdo_param_type paramtype)
665665
{
666-
int qcount = 0;
666+
size_t qcount = 0;
667667
char const *co, *l, *r;
668668
char *c;
669669

@@ -678,6 +678,10 @@ static int firebird_handle_quoter(pdo_dbh_t *dbh, const char *unquoted, size_t u
678678
/* count the number of ' characters */
679679
for (co = unquoted; (co = strchr(co,'\'')); qcount++, co++);
680680

681+
if (UNEXPECTED(unquotedlen + 2 > ZSTR_MAX_LEN - qcount)) {
682+
return 0;
683+
}
684+
681685
*quotedlen = unquotedlen + qcount + 2;
682686
*quoted = c = emalloc(*quotedlen+1);
683687
*c++ = '\'';

0 commit comments

Comments
 (0)