Fix GH-23016: pdo_odbc returns garbage for NULL long columns - #23045
Closed
iliaal wants to merge 1 commit into
Closed
Fix GH-23016: pdo_odbc returns garbage for NULL long columns#23045iliaal wants to merge 1 commit into
iliaal wants to merge 1 commit into
Conversation
LONG_COLUMN_BUFFER_SIZE derives from ZSTR_MAX_OVERHEAD, which is a size_t, so every comparison of the signed SQLLEN indicator against it was evaluated unsigned and SQL_NULL_DATA compared as SIZE_MAX. The early exit to in_data was skipped for NULL columns, and seed_len then clamped to LONG_COLUMN_BUFFER_SIZE - 1, seeding the result with uninitialized bytes from C->data. Cast the macro to SQLLEN and send negative indicators other than SQL_NO_TOTAL to in_data, which already maps them to NULL. The colsize and datalen comparisons keep their existing behaviour; both are unsigned quantities. Fixes phpGH-23016
NattyNarwhal
approved these changes
Aug 4, 2026
NattyNarwhal
left a comment
NattyNarwhal
left a comment
Member
There was a problem hiding this comment.
Doesn't reproduce with Db2i on macOS (as mentioned in linked issue)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LONG_COLUMN_BUFFER_SIZEderives fromZSTR_MAX_OVERHEAD, which is asize_t, soC->fetched_len < LONG_COLUMN_BUFFER_SIZEwas evaluated unsigned andSQL_NULL_DATAcompared asSIZE_MAX. A NULL long column therefore skipped the early exit toin_data, andseed_lenclamped toLONG_COLUMN_BUFFER_SIZE - 1, seeding the result with uninitialized bytes out ofC->data.Both comparisons predate 8.5.9. The 8.5 long column rewrite replaced the signed literal
256with the macro, which is why 8.4 is unaffected; 8.5.9 changed the seed from 0 bytes to 4064 and turned an empty string into a disclosure.Fixes #23016