File: 116-CVE-2007-0909_odbc.patch

package info (click to toggle)
php5 5.2.0%2Bdfsg-8%2Betch16
  • links: PTS
  • area: main
  • in suites: etch
  • size: 58,940 kB
  • ctags: 45,388
  • sloc: ansic: 533,605; sh: 17,835; php: 11,336; cpp: 4,289; xml: 3,809; yacc: 2,446; lex: 2,174; makefile: 1,150; tcl: 1,128; awk: 693; perl: 71; sql: 22; pascal: 15
file content (50 lines) | stat: -rw-r--r-- 1,617 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
diff -Nurp orig/ext/odbc/php_odbc.c new/ext/odbc/php_odbc.c
--- orig/ext/odbc/php_odbc.c	2007-02-21 08:58:37.000000000 +0100
+++ new/ext/odbc/php_odbc.c	2007-02-21 08:59:13.000000000 +0100
@@ -1991,12 +1991,12 @@ PHP_FUNCTION(odbc_result_all)
 						RETURN_FALSE;
 					}
 					if (rc == SQL_SUCCESS_WITH_INFO)
-						php_printf(buf,result->longreadlen);
+						PHPWRITE(buf, result->longreadlen);
 					else if (result->values[i].vallen == SQL_NULL_DATA) {
 						php_printf("<td>NULL</td>");
 						break;
 					} else {
-						php_printf(buf, result->values[i].vallen);
+						PHPWRITE(buf, result->values[i].vallen);
 					}
 					php_printf("</td>");
 					break;
@@ -2097,23 +2097,23 @@ int odbc_sqlconnect(odbc_connection **co
 			 if (strstr(db, "pwd") || strstr(db, "PWD")) {
 				 pwd = NULL;
 			 }
-			 strncpy( lpszConnStr, db, CONNSTRSIZE);
+			 strlcpy( lpszConnStr, db, CONNSTRSIZE);
 		 }
 		 else {
 			 strcpy(lpszConnStr, "DSN=");
-			 strcat(lpszConnStr, db);
+			 strlcat(lpszConnStr, db, CONNSTRSIZE);
 		 }
 		 if (uid) {
 			 if (uid[0]) {
-				 strcat(lpszConnStr, ";UID=");
-				 strcat(lpszConnStr, uid);
-				 strcat(lpszConnStr, ";");
+				 strlcat(lpszConnStr, ";UID=", CONNSTRSIZE);
+				 strlcat(lpszConnStr, uid, CONNSTRSIZE);
+				 strlcat(lpszConnStr, ";", CONNSTRSIZE);
 			 }
 			 if (pwd) {
 				 if (pwd[0]) {
-					 strcat(lpszConnStr, "PWD=");
-					 strcat(lpszConnStr, pwd);
-					 strcat(lpszConnStr, ";");
+					 strlcat(lpszConnStr, "PWD=", CONNSTRSIZE);
+					 strlcat(lpszConnStr, pwd, CONNSTRSIZE);
+					 strlcat(lpszConnStr, ";", CONNSTRSIZE);
 				 }
 			 }
 		 }