[PHP-CVS] [php-src] master: Merge branch 'PHP-8.5'

Author: Ilia Alshanetsky (iliaal)
Date: 2026-07-17T07:15:36-04:00

Commit: https://github.com/php/php-src/commit/c910d2c530b807f008e72aaa30c7b38d0cdc7d1f
Raw diff: https://github.com/php/php-src/commit/c910d2c530b807f008e72aaa30c7b38d0cdc7d1f.diff

Merge branch 'PHP-8.5'

* PHP-8.5:
  ext/odbc: do not mutate the caller's DSN string

Changed paths:
  A  ext/odbc/tests/gh_odbc_dsn_immutability.phpt
  M  ext/odbc/php_odbc.c


Diff:

diff --git a/ext/odbc/php_odbc.c b/ext/odbc/php_odbc.c
index 55cfba7e6833..4d3081a3b076 100644
--- a/ext/odbc/php_odbc.c
+++ b/ext/odbc/php_odbc.c
@@ -1952,9 +1952,9 @@ bool odbc_sqlconnect(zval *zv, char *db, char *uid, char *pwd, int cur_opt, bool
 
 			/* Force UID and PWD to be set in the DSN */
 			if (use_uid_arg || use_pwd_arg) {
-				db_end--;
-				if ((unsigned char)*(db_end) == ';') {
-					*db_end = '\0';
+				size_t base_len = db_len;
+				if (base_len > 0 && db[base_len - 1] == ';') {
+					base_len--;
 				}
 
 				char *uid_quoted = NULL, *pwd_quoted = NULL;
@@ -1970,7 +1970,7 @@ bool odbc_sqlconnect(zval *zv, char *db, char *uid, char *pwd, int cur_opt, bool
 					}
 
 					if (!use_pwd_arg) {
-						spprintf(&ldb, 0, "%s;UID=%s;", db, uid_quoted);
+						spprintf(&ldb, 0, "%.*s;UID=%s;", (int) base_len, db, uid_quoted);
 					}
 				}
 
@@ -1985,12 +1985,12 @@ bool odbc_sqlconnect(zval *zv, char *db, char *uid, char *pwd, int cur_opt, bool
 					}
 
 					if (!use_uid_arg) {
-						spprintf(&ldb, 0, "%s;PWD=%s;", db, pwd_quoted);
+						spprintf(&ldb, 0, "%.*s;PWD=%s;", (int) base_len, db, pwd_quoted);
 					}
 				}
 
 				if (use_uid_arg && use_pwd_arg) {
-					spprintf(&ldb, 0, "%s;UID=%s;PWD=%s;", db, uid_quoted, pwd_quoted);
+					spprintf(&ldb, 0, "%.*s;UID=%s;PWD=%s;", (int) base_len, db, uid_quoted, pwd_quoted);
 				}
 
 				if (uid_quoted && should_quote_uid) {
diff --git a/ext/odbc/tests/gh_odbc_dsn_immutability.phpt b/ext/odbc/tests/gh_odbc_dsn_immutability.phpt
new file mode 100644
index 000000000000..e3023b387c70
--- /dev/null
+++ b/ext/odbc/tests/gh_odbc_dsn_immutability.phpt
@@ -0,0 +1,20 @@
+--TEST--
+odbc_connect() must not mutate the caller's DSN string
+--EXTENSIONS--
+odbc
+--FILE--
+<?php
+/* The '=' selects the connection-string form and the trailing ';' is what the
+ * UID/PWD assembly used to overwrite with a NUL, in the caller's own buffer. */
+$dsn = 'Driver=DoesNotExist;Database=x;SS001;';
+const DSN_CONST = 'Driver=DoesNotExist;Database=x;SS001_CONST;';
+
+@odbc_connect($dsn, 'u', 'p');
+@odbc_connect(DSN_CONST, 'u', 'p');
+
+var_dump($dsn);
+var_dump(DSN_CONST);
+?>
+--EXPECT--
+string(37) "Driver=DoesNotExist;Database=x;SS001;"
+string(43) "Driver=DoesNotExist;Database=x;SS001_CONST;"