[GIT-PULLS] [php-src] PR #22735: Fix pdo_odbc output-buffer leak and stale-binding out-of-bounds read
[email protected] (iliaal)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22735
Author: iliaal
pdo_odbc bound each parameter with `SQLBindParameter` at `PDO_PARAM_EVT_ALLOC`, recording deferred pointers (`P->outbuf` for output, `&P->len`, and the bound-parameter struct itself for input) into the ODBC statement, and never freed `P->outbuf`. Both outlive the bound-parameter struct, which PDO destroys mid-statement when `execute()` is given an array or a position is rebound, so the output buffer leaked and the stale binding made the next `SQLExecute` read freed memory. This tracks the output buffers on the statement and frees them in the destructor after `SQLFreeHandle`, and defers `SQLBindParameter` to execute time, rebinding the current parameters when the parameter set has changed.
Reproducers, both under a debug or ASAN build:
```php
// out-of-bounds read (freed length indicator drives a wild over-read)
$stmt = $pdo->prepare('SELECT ? AS v');
$v = 'x';
$stmt->bindParam(1, $v, PDO::PARAM_STR | PDO::PARAM_INPUT_OUTPUT, 256);
$stmt->execute([]);
// leak of the output buffer
$stmt = $pdo->prepare('SELECT ? AS v');
$stmt->bindParam(1, $v, PDO::PARAM_STR | PDO::PARAM_INPUT_OUTPUT, 256);
$stmt->execute();
```