Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

[pdo_odbc] Buffer overflow / CWB0111 on SQL_BIT columns with IBM i Access ODBC Driver

Ouverte
  • Quelque chose ne va pas ?
#24,474 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
68/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
php, sql
Domaine
backend, databases

Piste de recherche

Start in ext/pdo_odbc/odbc_stmt.c at odbc_stmt_describe(), where SQL_DESC_DISPLAY_SIZE determines the SQL_BIT column buffer size; review the existing driver-specific length adjustments and the SQLBindCol call. Check whether the proposed minimum buffer handles the reported IBM i Access ODBC Driver behavior, then add or locate coverage for SQL_BIT fetching. Done means the reported BOOLEAN query fetches without CWB0111 while existing PDO ODBC behavior remains covered.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Bug Status: Needs Triage
Description

When fetching rows containing native BOOLEAN columns from IBM Db2 for i (IBM i 7.5+) using pdo_odbc with the official IBM i Access ODBC Driver (libcwbodbc.so), SQLFetchScroll throws a buffer overflow error:

SQLSTATE[22018]: Invalid character value for cast specification: 30200 
[IBM][System i Access ODBC Driver]Column X: CWB0111 - A buffer passed to a system call is too small to hold return data 
(SQLFetchScroll[30200] at ext/pdo_odbc/odbc_stmt.c:624)
Root Cause Analysis

In ext/pdo_odbc/odbc_stmt.c inside odbc_stmt_describe():

  1. pdo_odbc queries SQL_DESC_DISPLAY_SIZE via SQLColAttribute: 
    rc = SQLColAttribute(S->stmt, colno+1, SQL_DESC_DISPLAY_SIZE, NULL, 0, NULL, &displaysize);
colsize = displaysize;
  2. For an IBM i BOOLEAN column (ODBC type SQL_BIT / -7), the IBM driver reports a display size of 1.
  3. Because colsize < LONG_COLUMN_BUFFER_SIZE (1 < 256), pdo_odbc allocates a 2-byte fixed buffer (emalloc(colsize + 1)): 
    S->cols[colno].data = emalloc(colsize+1); // allocates 2 bytes
rc = SQLBindCol(S->stmt, colno+1,
    S->cols[colno].is_unicode ? SQL_C_BINARY : SQL_C_CHAR,
    S->cols[colno].data,
    S->cols[colno].datalen+1, &S->cols[colno].fetched_len);
  4. While the ODBC specification states that SQL_BIT converted to SQL_C_CHAR should return "0" or "1", the IBM i Access ODBC driver (libcwbodbc.so) formats boolean values as "TRUE" (5 bytes with null terminator) or "FALSE" (6 bytes with null terminator).
  5. During SQLFetchScroll, writing "FALSE\0" (6 bytes) into the 2-byte buffer triggers the driver's CWB0111 buffer overflow error.
PHP Version

PHP 8.3 / 8.4 / 8.5

Operating System & Environment
  • OS: Linux (Debian 12 / Ubuntu 24.04 / Docker)
  • ODBC Manager: unixODBC 2.3.12
  • ODBC Driver: IBM i Access Client Solutions (ibm-iaccess 1.1.0.29-1.0 / libcwbodbc.so)
  • Database: IBM Db2 for i (IBM i 7.5+)
Steps to Reproduce
  1. Connect to an IBM i 7.5+ system with pdo_odbc.
  2. Create a table with a native BOOLEAN column: 
    CREATE TABLE test_bool (id INT, is_active BOOLEAN);
INSERT INTO test_bool VALUES (1, FALSE);
  3. Run a query through PDO: 
    $pdo = new PDO('odbc:DRIVER={IBM i Access ODBC Driver};SYSTEM=...;', $user, $password);
$stmt = $pdo->query('SELECT is_active FROM test_bool');
$rows = $stmt->fetchAll(); // Throws CWB0111
Expected Result

The row should be fetched without errors (returning 'FALSE', '0' or boolean equivalent).

Actual Result
Fatal error: Uncaught PDOException: SQLSTATE[22018]: Invalid character value for cast specification: 30200 
[IBM][System i Access ODBC Driver]Column 1: CWB0111 - A buffer passed to a system call is too small to hold return data 
(SQLFetchScroll[30200] at ext/pdo_odbc/odbc_stmt.c:624)
Proposed Workaround / Solution in pdo_odbc

Just like pdo_odbc already has driver-specific adjustments in odbc_stmt_describe() for SQL Server lengths, pdo_odbc could ensure a minimum buffer of 6 bytes for SQL_BIT columns to safely accommodate non-compliant drivers that write "FALSE\0":

/* Ensure buffer can accommodate "FALSE\0" for drivers returning text booleans */
if (S->cols[colno].coltype == SQL_BIT && colsize < 6) {
    colsize = 5; // colsize + 1 will allocate 6 bytes
    S->cols[colno].datalen = colsize;
}
PHP Version
PHP 8.5.11 (cli) (built: Sep 24 2026 19:07:29) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.11, Copyright (c) Zend Technologies
    with Xdebug v3.5.3, Copyright (c) 2002-2026, by Derick Rethans
    with Zend OPcache v8.5.11, Copyright (c), by Zend Technologies
Operating System

Ubuntu 26.04

Langage dominant
C
Étoiles
40.7k
Forks
8.3k
Merge moyen
2 j 18 h
PR mergées (30 j)
159

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de php/php-src

Toutes les issues de php/php-src

Issues similaires

Plus d'issues C

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.