Blame SOURCES/php-5.6.5-CVE-2015-1352.patch

4c9102
From 968fbc6acf0bc27be17c0209be7f966e89a55943 Mon Sep 17 00:00:00 2001
4c9102
From: Stanislav Malyshev <stas@php.net>
4c9102
Date: Sun, 22 Mar 2015 18:20:59 -0700
4c9102
Subject: [PATCH] Bacport fix bug #68741 - Null pointer dereference
4c9102
4c9102
---
4c9102
 NEWS              | 3 +++
4c9102
 ext/pgsql/pgsql.c | 3 +++
4c9102
 2 files changed, 6 insertions(+)
4c9102
4c9102
diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
4c9102
index 16ce7bf..eb55777 100644
4c9102
--- a/ext/pgsql/pgsql.c
4c9102
+++ b/ext/pgsql/pgsql.c
4c9102
@@ -6484,6 +6484,9 @@ static inline void build_tablename(smart_str *querystr, PGconn *pg_link, const c
4c9102
 	/* schame.table should be "schame"."table" */
4c9102
 	table_copy = estrdup(table);
4c9102
 	token = php_strtok_r(table_copy, ".", &tmp);
4c9102
+	if (token == NULL) {
4c9102
+		token = table;
4c9102
+	}
4c9102
 	len = strlen(token);
4c9102
 	if (_php_pgsql_detect_identifier_escape(token, len) == SUCCESS) {
4c9102
 		smart_str_appendl(querystr, token, len);
4c9102
-- 
4c9102
2.1.4
4c9102
f90754
From 2cc4e69cc6d8dbc4b3568ad3dd583324a7c11d64 Mon Sep 17 00:00:00 2001
f90754
From: Remi Collet <remi@php.net>
f90754
Date: Wed, 20 May 2015 08:08:41 +0200
f90754
Subject: [PATCH] Fixed Bug #69667 segfault in php_pgsql_meta_data
f90754
f90754
Incomplete fix for #68741
f90754
---
f90754
 ext/pgsql/pg_insert_002.phpt | 27 +++++++++++++++++++++++++++
f90754
 ext/pgsql/pgsql.c            |  9 +++++++--
f90754
 2 files changed, 34 insertions(+), 2 deletions(-)
f90754
 create mode 100644 ext/pgsql/pg_insert_002.phpt
f90754
f90754
diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
f90754
index 23d55cb..5418b3c 100644
f90754
--- a/ext/pgsql/pgsql.c
f90754
+++ b/ext/pgsql/pgsql.c
f90754
@@ -5463,7 +5463,11 @@ PHP_PGSQL_API int php_pgsql_meta_data(PGconn *pg_link, const char *table_name, z
f90754
 
f90754
 	src = estrdup(table_name);
f90754
 	tmp_name = php_strtok_r(src, ".", &tmp_name2);
f90754
-	
f90754
+	if (!tmp_name) {
f90754
+		efree(src);
f90754
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The table name must be specified");
f90754
+		return FAILURE;
f90754
+	}
f90754
 	if (!tmp_name2 || !*tmp_name2) {
f90754
 		/* Default schema */
f90754
 		tmp_name2 = tmp_name;
f90754
@@ -6478,7 +6486,8 @@ static int do_exec(smart_str *querystr, int expect, PGconn *pg_link, ulong opt T
f90754
 
f90754
 static inline void build_tablename(smart_str *querystr, PGconn *pg_link, const char *table)
f90754
 {
f90754
-	char *table_copy, *escaped, *token, *tmp;
f90754
+	char *table_copy, *escaped, *tmp;
f90754
+	const char *token;
f90754
 	size_t len;
f90754
 
f90754
 	/* schame.table should be "schame"."table" */
f90754
-- 
f90754
2.1.4
f90754
f90754
From 3be4e5d71af3d7f495876fabd5a9ce46580e2d0d Mon Sep 17 00:00:00 2001
f90754
From: Remi Collet <remi@php.net>
f90754
Date: Wed, 20 May 2015 14:02:13 +0200
f90754
Subject: [PATCH] move test
f90754
f90754
---
f90754
 ext/pgsql/pg_insert_002.phpt       | 27 ---------------------------
f90754
 ext/pgsql/tests/pg_insert_002.phpt | 27 +++++++++++++++++++++++++++
f90754
 2 files changed, 27 insertions(+), 27 deletions(-)
f90754
 delete mode 100644 ext/pgsql/pg_insert_002.phpt
f90754
 create mode 100644 ext/pgsql/tests/pg_insert_002.phpt
f90754
f90754
diff --git a/ext/pgsql/tests/pg_insert_002.phpt b/ext/pgsql/tests/pg_insert_002.phpt
f90754
new file mode 100644
f90754
index 0000000..87d87b8
f90754
--- /dev/null
f90754
+++ b/ext/pgsql/tests/pg_insert_002.phpt
f90754
@@ -0,0 +1,27 @@
f90754
+--TEST--
f90754
+PostgreSQL pg_select() - basic test using schema
f90754
+--SKIPIF--
f90754
+
f90754
+--FILE--
f90754
+
f90754
+
f90754
+include('config.inc');
f90754
+
f90754
+$conn = pg_connect($conn_str);
f90754
+
f90754
+foreach (array('', '.', '..') as $table) {
f90754
+	var_dump(pg_insert($conn, $table,  array('id' => 1, 'id2' => 1)));
f90754
+}
f90754
+?>
f90754
+Done
f90754
+--EXPECTF--
f90754
+
f90754
+Warning: pg_insert(): The table name must be specified in %s on line %d
f90754
+bool(false)
f90754
+
f90754
+Warning: pg_insert(): The table name must be specified in %s on line %d
f90754
+bool(false)
f90754
+
f90754
+Warning: pg_insert(): The table name must be specified in %s on line %d
f90754
+bool(false)
f90754
+Done
f90754
\ No newline at end of file
f90754
-- 
f90754
2.1.4
f90754