[GIT-PULLS] [php-src] PR #22674: Fix GH-22666: pdo_odbc heap overflow on oversized output param

[email protected] (iliaal)
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22674
Author: iliaal

ext/pdo_odbc sizes an output-param buffer from the declared maxlen but copies the runtime value in by its own length (heap write overflow) and reads it back by the driver-reported length, which on a truncated OUTPUT value exceeds the buffer (01004 over-read). Records the bound capacity and clamps both the input copy and the read-back to it. Over-long values are bounded to maxlen, which is all the driver round-trips anyway since the buffer is bound at maxlen before the value is known. Reproduces with the SQLite3 ODBC driver; the test skips without it.

Fixes #22666
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.