Add or correct bounds checking for sqlite dbd backends.

Submitted by: Bojan Smojver <bojan rexursive.com>

* dbd/apr_dbd_sqlite2.c
  (dbd_sqlite_get_entry): Add bounds checking.

* dbd/apr_dbd_sqlite3.c
  (dbd_sqlite3_get_entry): Correct bounds checking on negative values.


git-svn-id: http://svn.apache.org/repos/asf/apr/apr-util/trunk@384327 13f79535-47bb-0310-9956-ffa450edef68

2 files changed, 5 insertions, 1 deletions

diff --git a/dbd/apr_dbd_sqlite2.c b/dbd/apr_dbd_sqlite2.c
index cbf56af0..0444d004 100644
--- a/dbd/apr_dbd_sqlite2.c
+++ b/dbd/apr_dbd_sqlite2.c
@@ -168,6 +168,10 @@ static int dbd_sqlite_get_row(apr_pool_t * pool, apr_dbd_results_t * res,
 
 static const char *dbd_sqlite_get_entry(const apr_dbd_row_t * row, int n)
 {
+    if ((n < 0) || (n >= row->res->sz)) {
+      return NULL;
+    }
+
     return row->data[n];
 }
 
diff --git a/dbd/apr_dbd_sqlite3.c b/dbd/apr_dbd_sqlite3.c
index c01891b7..2a2fea83 100644
--- a/dbd/apr_dbd_sqlite3.c
+++ b/dbd/apr_dbd_sqlite3.c
@@ -217,7 +217,7 @@ static const char *dbd_sqlite3_get_entry(const apr_dbd_row_t *row, int n)
 {
     apr_dbd_column_t *column;
     const char *value;
-    if ((n + 1) > row->columnCount) {
+    if ((n < 0) || (n >= row->columnCount)) {
         return NULL;
     }
     column = row->columns[n];