PDO_FIREBIRD isc_interprete and fb_interpret

Something that has been bugging me for a long time is the use of 
isc_interprete in the pdo_firebird driver. This call is used to parse the 
error array and output error messages. It is vulnerable to a buffer overflow 
and has been deprecated by the Firebird project for quite a while now. It has 
been replaced by fb_interpret which takes a third parameter specifying the 
size of the buffer. Unfortunately the interbase guys have done nothing to fix 
this on their side.

What is the correct course of action? :

1/ Replace isc_interprete entirely with fb_interpret. 
This breaks support in pdo_firebird for interbase. (But hey, this is the 
pdo_firebird driver.)

2/ Determine at runtime if fb_interpret is available and use it. Otherwise 
fall back to isc_interprete.
I've tried coding that and it works, although it is a bit messy. However, I'm 
not wild about trying to test for a function's existence in the middle of 
throwing an error.

3/ Hard-code the function at compile time. By default it would use 
fb_interpret but a user could compile for isc_interprete if required. Although 
clunky this would at least allow us to remove an attack vector from regular 
builds while providing some support for interbase users. 

Thoughts?



Paul
-- 
Paul Reeves
http://www.ibphoenix.com
Specialists in Firebird support