Skip to content

Commit d0e1a4f

Browse files
committed
MFH: fix #36113 (Reading records of unsupported type causes segfault)
1 parent ff438f1 commit d0e1a4f

File tree

2 files changed

+9
-4
lines changed

2 files changed

+9
-4
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ PHP NEWS
1111
on error. (Pierre)
1212
- Fixed bug #36134 (DirectoryIterator constructor failed to detect empty
1313
directory names). (Ilia)
14+
- Fixed bug #36113 (Reading records of unsupported type causes segfault).
15+
(Tony)
1416
- Fixed bug #36096 (oci_result() returns garbage after oci_fetch() failed).
1517
(Tony)
1618
- Fixed bug #36071 (Engine Crash related with 'clone'). (Dmitry)

ext/dbase/dbf_head.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ dbhead_t *get_dbf_head(int fd)
2424
dbfield_t *dbf, *cur_f, *tdbf;
2525
int ret, nfields, offset, gf_retval;
2626

27-
if ((dbh = (dbhead_t *)malloc(sizeof(dbhead_t))) == NULL)
27+
if ((dbh = (dbhead_t *)calloc(1, sizeof(dbhead_t))) == NULL)
2828
return NULL;
2929
if (lseek(fd, 0, 0) < 0)
3030
return NULL;
@@ -44,7 +44,7 @@ dbhead_t *get_dbf_head(int fd)
4444

4545
/* malloc enough memory for the maximum number of fields:
4646
32 * 1024 = 32K dBase5 (for Win) seems to allow that many */
47-
tdbf = (dbfield_t *)malloc(sizeof(dbfield_t)*1024);
47+
tdbf = (dbfield_t *)calloc(1, sizeof(dbfield_t)*1024);
4848

4949
offset = 1;
5050
nfields = 0;
@@ -157,7 +157,8 @@ int get_dbf_field(dbhead_t *dbh, dbfield_t *dbf)
157157
}
158158

159159
if ((dbf->db_format = get_dbf_f_fmt(dbf)) == NULL) {
160-
return 1;
160+
/* something went wrong, most likely this fieldtype is not supported */
161+
return -1;
161162
}
162163

163164
return 0;
@@ -235,6 +236,8 @@ char *get_dbf_f_fmt(dbfield_t *dbf)
235236
case 'M':
236237
strcpy(format, "%s");
237238
break;
239+
default:
240+
return NULL;
238241
}
239242
return (char *)strdup(format);
240243
}
@@ -256,7 +259,7 @@ dbhead_t *dbf_open(char *dp, int o_flags TSRMLS_DC)
256259
}
257260
}
258261

259-
if ((dbh = get_dbf_head(fd)) == 0) {
262+
if ((dbh = get_dbf_head(fd)) == NULL) {
260263
fprintf(stderr, "Unable to get header\n");
261264
return NULL;
262265
}

0 commit comments

Comments
 (0)