[GIT-PULLS] [php-src] PR #22675: Fix GH-22665: pdo_odbc OOB write on oversized diagnostic length

[email protected] (iliaal)
Newsgroups php.git-pulls
Message-ID <ZGO0DKzmhJQQisLClLnbxq4nXU3ZVKBRaMgY3taOIxs@main.internal.php.net>
Pull Request: https://github.com/php/php-src/pull/22675
Author: iliaal

pdo_odbc_error() NUL-terminates the diagnostic buffer at the length SQLGetDiagRec reports, which on a truncated message is the full untruncated length and can reach or exceed the 512-byte last_err_msg buffer, writing the terminator out of bounds into the adjacent last_error field. Clamps the index to sizeof-1; the size_t cast also covers a negative driver-reported length. Reproduces with the SQLite3 ODBC driver (reports 512) via a failing query whose long identifier lengthens the message; the test skips without that driver.

Fixes #22665
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.