MFB: Fixed bug #44189 (PDO setAttribute() does not properly validate values

for native numeric options)

diff --git a/NEWS b/NEWS
index 89ddd6314ce90277390782ba34e74268253c3da5..3f40181fdbc57a245958a0c44d9b4cd6ba4eb8dc 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,8 @@ PHP                                                                        NEWS
 
 - Fixed bug #44197 (socket array keys lost on socket_select). (Felipe)
 - Fixed bug #44191 (preg_grep messes up array index). (Felipe)
+- Fixed bug #44189 (PDO setAttribute() does not properly validate values for 
+  native numeric options). (Ilia)
 - Fixed bug #44184 (Double free of loop-variable on exception). (Dmitry)
 - Fixed bug #44171 (Invalid FETCH_COLUMN index does not raise an error). (Ilia)
 - Fixed bug #44159 (Crash: $pdo->setAttribute(PDO::STATEMENT_ATTR_CLASS, NULL)).

diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c
index c017fa754edc0ac7a0cd99615813c1a4dec61e40..d8c5034637797ae4eb7a7354ab233261822c2334 100755 (executable)
--- a/ext/pdo/pdo_dbh.c
+++ b/ext/pdo/pdo_dbh.c
@@ -669,8 +669,17 @@ static PHP_METHOD(PDO, rollBack)
 
 static int pdo_dbh_attribute_set(pdo_dbh_t *dbh, long attr, zval *value TSRMLS_DC) /* {{{ */
 {
+
+#define PDO_LONG_PARAM_CHECK \
+       if (Z_TYPE_P(value) != IS_LONG && Z_TYPE_P(value) != IS_STRING && Z_TYPE_P(value) != IS_BOOL) { \
+               pdo_raise_impl_error(dbh, NULL, "HY000", "attribute value must be an integer" TSRMLS_CC); \
+               PDO_HANDLE_DBH_ERR(); \
+               return FAILURE; \
+       } \
+
        switch (attr) {
                case PDO_ATTR_ERRMODE:
+                       PDO_LONG_PARAM_CHECK;
                        convert_to_long(value);
                        switch (Z_LVAL_P(value)) {
                                case PDO_ERRMODE_SILENT:
@@ -686,6 +695,7 @@ static int pdo_dbh_attribute_set(pdo_dbh_t *dbh, long attr, zval *value TSRMLS_D
                        return FAILURE;
 
                case PDO_ATTR_CASE:
+                       PDO_LONG_PARAM_CHECK;
                        convert_to_long(value);
                        switch (Z_LVAL_P(value)) {
                                case PDO_CASE_NATURAL:
@@ -701,6 +711,7 @@ static int pdo_dbh_attribute_set(pdo_dbh_t *dbh, long attr, zval *value TSRMLS_D
                        return FAILURE;
 
                case PDO_ATTR_ORACLE_NULLS:
+                       PDO_LONG_PARAM_CHECK;
                        convert_to_long(value);
                        dbh->oracle_nulls = Z_LVAL_P(value);
                        return SUCCESS;
@@ -714,6 +725,8 @@ static int pdo_dbh_attribute_set(pdo_dbh_t *dbh, long attr, zval *value TSRMLS_D
                                                return FAILURE;
                                        }
                                }
+                       } else {
+                               PDO_LONG_PARAM_CHECK;
                        }
                        convert_to_long(value);
                        if (Z_LVAL_P(value) == PDO_FETCH_USE_DEFAULT) {
@@ -724,6 +737,7 @@ static int pdo_dbh_attribute_set(pdo_dbh_t *dbh, long attr, zval *value TSRMLS_D
                        return SUCCESS;
 
                case PDO_ATTR_STRINGIFY_FETCHES:
+                       PDO_LONG_PARAM_CHECK;
                        convert_to_long(value);
                        dbh->stringify = Z_LVAL_P(value) ? 1 : 0;
                        return SUCCESS;