Skip to content

Commit 2fd278b

Browse files
committed
sqlite3: Fix possible use after free
Exception should be thrown before the db handle is destroyed. The backtrace excerpt ==26628== Invalid read of size 4 ==26628== at 0x53C49E3: sqlite3_errmsg (in /usr/lib64/libsqlite3.so.0.8.6) ==26628== by 0x38C4E9: zim_sqlite3_open (sqlite3.c:142) ==26628== by 0x8977BF: ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1618) ==26628== by 0x8F801E: execute_ex (zend_vm_execute.h:53824) ==26628== by 0x8FC0BB: zend_execute (zend_vm_execute.h:57920) ==26628== by 0x828F54: zend_execute_scripts (zend.c:1672) ==26628== by 0x793C2C: php_execute_script (main.c:2621) ==26628== by 0x8FEA44: do_cli (php_cli.c:964) ==26628== by 0x8FF9DC: main (php_cli.c:1359) Signed-off-by: Anatol Belski <[email protected]>
1 parent 2a6f2d8 commit 2fd278b

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

ext/sqlite3/sqlite3.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,13 +136,13 @@ PHP_METHOD(sqlite3, open)
136136

137137
rc = sqlite3_open_v2(fullpath, &(db_obj->db), flags, NULL);
138138
if (rc != SQLITE_OK) {
139-
sqlite3_close(db_obj->db);
140139
zend_throw_exception_ex(zend_ce_exception, 0, "Unable to open database: %s",
141140
#ifdef HAVE_SQLITE3_ERRSTR
142141
db_obj->db ? sqlite3_errmsg(db_obj->db) : sqlite3_errstr(rc));
143142
#else
144143
db_obj->db ? sqlite3_errmsg(db_obj->db) : "");
145144
#endif
145+
sqlite3_close(db_obj->db);
146146
if (fullpath != filename) {
147147
efree(fullpath);
148148
}
@@ -152,8 +152,8 @@ PHP_METHOD(sqlite3, open)
152152
#if SQLITE_HAS_CODEC
153153
if (encryption_key_len > 0) {
154154
if (sqlite3_key(db_obj->db, encryption_key, encryption_key_len) != SQLITE_OK) {
155-
sqlite3_close(db_obj->db);
156155
zend_throw_exception_ex(zend_ce_exception, 0, "Unable to open database: %s", sqlite3_errmsg(db_obj->db));
156+
sqlite3_close(db_obj->db);
157157
return;
158158
}
159159
}

0 commit comments

Comments
 (0)