Fix GH-23016: pdo_odbc returns garbage for NULL long columns - #213
Closed
iliaal wants to merge 1 commit into
Closed
Conversation
iliaal
force-pushed
the
fix/gh-23016-odbc-null-long-column
branch
from
August 4, 2026 17:39
94c8491 to
8931c2d
Compare
LONG_COLUMN_BUFFER_SIZE derives from ZSTR_MAX_OVERHEAD, which is a size_t, so every comparison of the signed SQLLEN indicator against it was evaluated unsigned and SQL_NULL_DATA compared as SIZE_MAX. The early exit to in_data was skipped for NULL columns, and seed_len then clamped to LONG_COLUMN_BUFFER_SIZE - 1, seeding the result with uninitialized bytes from C->data. Cast the macro to SQLLEN and send negative indicators other than SQL_NO_TOTAL to in_data, which already maps them to NULL. The colsize and datalen comparisons keep their existing behaviour; both are unsigned quantities. Fixes phpGH-23016
iliaal
force-pushed
the
fix/gh-23016-odbc-null-long-column
branch
from
August 4, 2026 17:43
8931c2d to
eded7f7
Compare
Owner
Author
|
Submitted upstream as php#23045. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LONG_COLUMN_BUFFER_SIZEderives fromZSTR_MAX_OVERHEAD, which is asize_t, soC->fetched_len < LONG_COLUMN_BUFFER_SIZEwas evaluated unsigned andSQL_NULL_DATAcompared asSIZE_MAX. A NULL long column therefore skipped the early exit toin_data, andseed_lenclamped toLONG_COLUMN_BUFFER_SIZE - 1, seeding the result with uninitialized bytes out ofC->data.Both comparisons predate 8.5.9. The 8.5 long column rewrite replaced the signed literal
256with the macro, which is why 8.4 is unaffected; 8.5.9 changed the seed from 0 bytes to 4064 and turned an empty string into a disclosure.