[GIT-PULLS] [php-src] PR #22735: Fix pdo_odbc output-buffer leak and stale-binding out-of-bounds read

[email protected] (iliaal)
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22735
Author: iliaal

pdo_odbc bound each parameter with `SQLBindParameter` at `PDO_PARAM_EVT_ALLOC`, recording deferred pointers (`P->outbuf` for output, `&P->len`, and the bound-parameter struct itself for input) into the ODBC statement, and never freed `P->outbuf`. Both outlive the bound-parameter struct, which PDO destroys mid-statement when `execute()` is given an array or a position is rebound, so the output buffer leaked and the stale binding made the next `SQLExecute` read freed memory. This tracks the output buffers on the statement and frees them in the destructor after `SQLFreeHandle`, and defers `SQLBindParameter` to execute time, rebinding the current parameters when the parameter set has changed.

Reproducers, both under a debug or ASAN build:

```php
// out-of-bounds read (freed length indicator drives a wild over-read)
$stmt = $pdo->prepare('SELECT ? AS v');
$v = 'x';
$stmt->bindParam(1, $v, PDO::PARAM_STR | PDO::PARAM_INPUT_OUTPUT, 256);
$stmt->execute([]);

// leak of the output buffer
$stmt = $pdo->prepare('SELECT ? AS v');
$stmt->bindParam(1, $v, PDO::PARAM_STR | PDO::PARAM_INPUT_OUTPUT, 256);
$stmt->execute();
```
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.