mirror of
https://github.com/php/php-src.git
synced 2026-10-29 02:07:35 +08:00
Ilia Alshanetsky
c135a869c1
The conversion of the data parameter to Z_PARAM_PATH_STR() made pg_lo_write() reject any data containing a null byte, breaking writes of arbitrary binary payloads which were accepted before. Accept embedded null bytes again by parsing the data as a length-aware string. Sibling audit: the other Z_PARAM_PATH* conversions from the same change (pg_connect(), pg_lo_import(), table/statement identifiers) operate on paths or SQL text where null-byte rejection is intentional. Closes GH-23649
50 lines
1.2 KiB
PHP
50 lines
1.2 KiB
PHP
--TEST--
|
|
pg_lo_write() must accept data containing null bytes
|
|
--EXTENSIONS--
|
|
pgsql
|
|
--SKIPIF--
|
|
<?php include("inc/skipif.inc"); ?>
|
|
--FILE--
|
|
<?php
|
|
include('inc/config.inc');
|
|
|
|
$db = pg_connect($conn_str);
|
|
pg_exec($db, "BEGIN");
|
|
$oid = pg_lo_create($db);
|
|
$handle = pg_lo_open($db, $oid, "w");
|
|
var_dump(pg_lo_write($handle, "bin\0ary\0data"));
|
|
var_dump(pg_lo_write($handle, "ab\0cd", 4));
|
|
var_dump(pg_lo_write($handle, "ab\0cd", 2));
|
|
var_dump(pg_lo_write($handle, "", 0));
|
|
try {
|
|
pg_lo_write($handle, "abc", -1);
|
|
} catch (Throwable $e) {
|
|
echo $e::class, ": ", $e->getMessage(), "\n";
|
|
}
|
|
try {
|
|
pg_lo_write($handle, "abc", 4);
|
|
} catch (Throwable $e) {
|
|
echo $e::class, ": ", $e->getMessage(), "\n";
|
|
}
|
|
pg_lo_close($handle);
|
|
pg_exec($db, "ROLLBACK");
|
|
|
|
pg_exec($db, "BEGIN");
|
|
$oid = pg_lo_create($db);
|
|
$handle = pg_lo_open($db, $oid, "w");
|
|
pg_lo_write($handle, "x\0y");
|
|
pg_lo_close($handle);
|
|
$handle = pg_lo_open($db, $oid, "r");
|
|
var_dump(bin2hex(pg_lo_read($handle)));
|
|
pg_lo_close($handle);
|
|
pg_exec($db, "ROLLBACK");
|
|
?>
|
|
--EXPECT--
|
|
int(12)
|
|
int(4)
|
|
int(2)
|
|
int(0)
|
|
ValueError: pg_lo_write(): Argument #3 ($length) must be greater than or equal to 0
|
|
ValueError: pg_lo_write(): Argument #3 ($length) must be less than or equal to the length of argument #2 ($buf)
|
|
string(6) "780079"
|