[GIT-PULLS] [php-src] PR #22674: Fix GH-22666: pdo_odbc heap overflow on oversized output param
[email protected] (iliaal)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22674 Author: iliaal ext/pdo_odbc sizes an output-param buffer from the declared maxlen but copies the runtime value in by its own length (heap write overflow) and reads it back by the driver-reported length, which on a truncated OUTPUT value exceeds the buffer (01004 over-read). Records the bound capacity and clamps both the input copy and the read-back to it. Over-long values are bounded to maxlen, which is all the driver round-trips anyway since the buffer is bound at maxlen before the value is known. Reproduces with the SQLite3 ODBC driver; the test skips without it. Fixes #22666