Project

General

Profile

Bug #4973

SPI functions can crash the backend

Added by Álvaro Herrera almost 19 years ago. Updated almost 19 years ago.

Status:
Closed
Priority:
Urgent
Assignee:
Álvaro Herrera
Target version:
Release 1.1
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
fixed

Description

Creating an invalid array can make spi_fetch_row crash. Example function:

create function crash() returns void language plphp as $$
$a = array('res' => 123);
spi_fetch_row($a);
$$;

Just invoking this function makes PL/php crash. This is because the server tries to dereference a pointer that the user can change. This is stupid. The solution seems to be to change the SPI functions to use PHP "resources".

Also available in: Atom PDF