[GIT-PULLS] [php-src] PR #22675: Fix GH-22665: pdo_odbc OOB write on oversized diagnostic length
[email protected] (iliaal)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <ZGO0DKzmhJQQisLClLnbxq4nXU3ZVKBRaMgY3taOIxs@main.internal.php.net> |
Pull Request: https://github.com/php/php-src/pull/22675 Author: iliaal pdo_odbc_error() NUL-terminates the diagnostic buffer at the length SQLGetDiagRec reports, which on a truncated message is the full untruncated length and can reach or exceed the 512-byte last_err_msg buffer, writing the terminator out of bounds into the adjacent last_error field. Clamps the index to sizeof-1; the size_t cast also covers a negative driver-reported length. Reproduces with the SQLite3 ODBC driver (reports 512) via a failing query whose long identifier lengthens the message; the test skips without that driver. Fixes #22665