Blame SOURCES/php-5.5.21-CVE-2015-1352.patch

8bac60
From 968fbc6acf0bc27be17c0209be7f966e89a55943 Mon Sep 17 00:00:00 2001
8bac60
From: Stanislav Malyshev <stas@php.net>
8bac60
Date: Sun, 22 Mar 2015 18:20:59 -0700
8bac60
Subject: [PATCH] Bacport fix bug #68741 - Null pointer dereference
8bac60
8bac60
---
8bac60
 NEWS              | 3 +++
8bac60
 ext/pgsql/pgsql.c | 3 +++
8bac60
 2 files changed, 6 insertions(+)
8bac60
8bac60
diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
8bac60
index 16ce7bf..eb55777 100644
8bac60
--- a/ext/pgsql/pgsql.c
8bac60
+++ b/ext/pgsql/pgsql.c
8bac60
@@ -6118,6 +6118,9 @@ static inline void build_tablename(smart_str *querystr, PGconn *pg_link, const c
8bac60
 	/* schame.table should be "schame"."table" */
8bac60
 	table_copy = estrdup(table);
8bac60
 	token = php_strtok_r(table_copy, ".", &tmp);
8bac60
+	if (token == NULL) {
8bac60
+		token = table;
8bac60
+	}
8bac60
 	len = strlen(token);
8bac60
 	if (_php_pgsql_detect_identifier_escape(token, len) == SUCCESS) {
8bac60
 		smart_str_appendl(querystr, token, len);
8bac60
-- 
8bac60
2.1.4
8bac60
30ceb2
From 2cc4e69cc6d8dbc4b3568ad3dd583324a7c11d64 Mon Sep 17 00:00:00 2001
30ceb2
From: Remi Collet <remi@php.net>
30ceb2
Date: Wed, 20 May 2015 08:08:41 +0200
30ceb2
Subject: [PATCH] Fixed Bug #69667 segfault in php_pgsql_meta_data
30ceb2
30ceb2
Incomplete fix for #68741
30ceb2
---
30ceb2
 ext/pgsql/pg_insert_002.phpt | 27 +++++++++++++++++++++++++++
30ceb2
 ext/pgsql/pgsql.c            |  9 +++++++--
30ceb2
 2 files changed, 34 insertions(+), 2 deletions(-)
30ceb2
 create mode 100644 ext/pgsql/pg_insert_002.phpt
30ceb2
30ceb2
diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
30ceb2
index 23d55cb..5418b3c 100644
30ceb2
--- a/ext/pgsql/pgsql.c
30ceb2
+++ b/ext/pgsql/pgsql.c
30ceb2
@@ -5104,7 +5104,11 @@ PHP_PGSQL_API int php_pgsql_meta_data(PGconn *pg_link, const char *table_name, z
30ceb2
 
30ceb2
 	src = estrdup(table_name);
30ceb2
 	tmp_name = php_strtok_r(src, ".", &tmp_name2);
30ceb2
-	
30ceb2
+	if (!tmp_name) {
30ceb2
+		efree(src);
30ceb2
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The table name must be specified");
30ceb2
+		return FAILURE;
30ceb2
+	}
30ceb2
 	if (!tmp_name2 || !*tmp_name2) {
30ceb2
 		/* Default schema */
30ceb2
 		tmp_name2 = tmp_name;
30ceb2
@@ -6112,7 +6116,8 @@ static int do_exec(smart_str *querystr, int expect, PGconn *pg_link, ulong opt T
30ceb2
 
30ceb2
 static inline void build_tablename(smart_str *querystr, PGconn *pg_link, const char *table)
30ceb2
 {
30ceb2
-	char *table_copy, *escaped, *token, *tmp;
30ceb2
+	char *table_copy, *escaped, *tmp;
30ceb2
+	const char *token;
30ceb2
 	size_t len;
30ceb2
 
30ceb2
 	/* schame.table should be "schame"."table" */
30ceb2
-- 
30ceb2
2.1.4
30ceb2
30ceb2
From 3be4e5d71af3d7f495876fabd5a9ce46580e2d0d Mon Sep 17 00:00:00 2001
30ceb2
From: Remi Collet <remi@php.net>
30ceb2
Date: Wed, 20 May 2015 14:02:13 +0200
30ceb2
Subject: [PATCH] move test
30ceb2
30ceb2
---
30ceb2
 ext/pgsql/pg_insert_002.phpt       | 27 ---------------------------
30ceb2
 ext/pgsql/tests/pg_insert_002.phpt | 27 +++++++++++++++++++++++++++
30ceb2
 2 files changed, 27 insertions(+), 27 deletions(-)
30ceb2
 delete mode 100644 ext/pgsql/pg_insert_002.phpt
30ceb2
 create mode 100644 ext/pgsql/tests/pg_insert_002.phpt
30ceb2
30ceb2
diff --git a/ext/pgsql/tests/pg_insert_002.phpt b/ext/pgsql/tests/pg_insert_002.phpt
30ceb2
new file mode 100644
30ceb2
index 0000000..87d87b8
30ceb2
--- /dev/null
30ceb2
+++ b/ext/pgsql/tests/pg_insert_002.phpt
30ceb2
@@ -0,0 +1,27 @@
30ceb2
+--TEST--
30ceb2
+PostgreSQL pg_select() - basic test using schema
30ceb2
+--SKIPIF--
30ceb2
+
30ceb2
+--FILE--
30ceb2
+
30ceb2
+
30ceb2
+include('config.inc');
30ceb2
+
30ceb2
+$conn = pg_connect($conn_str);
30ceb2
+
30ceb2
+foreach (array('', '.', '..') as $table) {
30ceb2
+	var_dump(pg_insert($conn, $table,  array('id' => 1, 'id2' => 1)));
30ceb2
+}
30ceb2
+?>
30ceb2
+Done
30ceb2
+--EXPECTF--
30ceb2
+
30ceb2
+Warning: pg_insert(): The table name must be specified in %s on line %d
30ceb2
+bool(false)
30ceb2
+
30ceb2
+Warning: pg_insert(): The table name must be specified in %s on line %d
30ceb2
+bool(false)
30ceb2
+
30ceb2
+Warning: pg_insert(): The table name must be specified in %s on line %d
30ceb2
+bool(false)
30ceb2
+Done
30ceb2
\ No newline at end of file
30ceb2
-- 
30ceb2
2.1.4
30ceb2