Fixed a possible memory corruption in dbase_open() with invalid open mode

Ilia Alshanetsky · Ilia Alshanetsky · commit b3004fb883d4 · 2006-12-01T19:10:50.000Z
diff --git a/ext/dbase/dbase.c b/ext/dbase/dbase.c
@@ -137,7 +137,7 @@ PHP_FUNCTION(dbase_open)
 	if (Z_LVAL_PP(options) == 1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot open %s in write-only mode", Z_STRVAL_PP(dbf_name));
 		RETURN_FALSE;
-	} else if (Z_LVAL_PP(options) < 0) {
+	} else if (Z_LVAL_PP(options) < 0 || Z_LVAL_PP(options) > 3) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid access mode %ld", Z_LVAL_PP(options));
 		RETURN_FALSE;
 	}
diff --git a/ext/dbase/tests/002.phpt b/ext/dbase/tests/002.phpt
@@ -38,7 +38,7 @@ echo "Done\n";
 Warning: dbase_open(): Invalid access mode -1 in %s on line %d
 bool(false)
 
-Warning: dbase_open(): unable to open database %s in %s on line %d
+Warning: dbase_open(): Invalid access mode 1000 in %s on line %d
 bool(false)
 
 Warning: dbase_open(): unable to open database %s in %s on line %d

Original file line number	Diff line number	Diff line change
`@@ -137,7 +137,7 @@ PHP_FUNCTION(dbase_open)`
`137`	`137`	`if (Z_LVAL_PP(options) == 1) {`
`138`	`138`	`php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot open %s in write-only mode", Z_STRVAL_PP(dbf_name));`
`139`	`139`	`RETURN_FALSE;`
`140`		`- } else if (Z_LVAL_PP(options) < 0) {`
	`140`	`+ } else if (Z_LVAL_PP(options) < 0 \|\| Z_LVAL_PP(options) > 3) {`
`141`	`141`	`php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid access mode %ld", Z_LVAL_PP(options));`
`142`	`142`	`RETURN_FALSE;`
`143`	`143`	`}`