archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

ext/pdo_sqlite - throw on null bytes / resolve GH-13952 (#18320)

Browse source 
fix a corruption issue where PDO::quote for SQLite would silently truncate
strings with null bytes in them, by throwing.

Fixes #13952
Closes #18320
This commit is contained in:
hanshenrik 2025-04-13 18:45:51 +02:00 • committed by Saki Takamachi
parent 93ad8e8db2
commit 0a10f6db26
No known key found for this signature in database
GPG key ID: 770426E17EBBB3DD
4 changed files with 100 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
ext/pdo_sqlite/sqlite_driver.c
View file

@ -226,6 +226,19 @@ static zend_string* sqlite_handle_quoter(pdo_dbh_t *dbh, const zend_string *unqu
if (ZSTR_LEN(unquoted) > (INT_MAX - 3) / 2) {
return NULL;
}
if (UNEXPECTED(zend_str_has_nul_byte(unquoted))) {
if (dbh->error_mode == PDO_ERRMODE_EXCEPTION) {
zend_throw_exception_ex(
php_pdo_get_exception(), 0,
"SQLite PDO::quote does not support null bytes");
} else if (dbh->error_mode == PDO_ERRMODE_WARNING) {
php_error_docref(NULL, E_WARNING,
"SQLite PDO::quote does not support null bytes");
}
return NULL;
}
quoted = safe_emalloc(2, ZSTR_LEN(unquoted), 3);
/* TODO use %Q format? */
sqlite3_snprintf(2*ZSTR_LEN(unquoted) + 3, quoted, "'%q'", ZSTR_VAL(unquoted));
@ -741,7 +754,7 @@ static const struct pdo_dbh_methods sqlite_methods = {
pdo_sqlite_request_shutdown,
pdo_sqlite_in_transaction,
pdo_sqlite_get_gc,
pdo_sqlite_scanner
pdo_sqlite_scanner
};
static char *make_filename_safe(const char *filename)