PDOStatement::getColumnMeta() reads out of bounds for out-of-range column index (pdo_firebird) #25006

Description

PDOStatement::getColumnMeta() (ext/pdo/pdo_stmt.c) only checks colno < 0 before calling the driver; the colno >= column_count check comes after the dispatch. pdo_firebird_stmt_get_column_meta() (ext/pdo_firebird/firebird_statement.c ~L332) does &S->out_sqlda.sqlvar[colno] with no bound check, so the driver reads out of bounds first. pdo_sqlite, pdo_mysql and pdo_pgsql check the upper bound themselves.

The following code:

<?php
$dbh = new PDO('firebird:dbname=c:/tmp/fbdb/t.fdb', 'SYSDBA', 'masterkey');
$st = $dbh->prepare('SELECT 1, 2 FROM RDB$DATABASE');
$st->execute();
var_dump($st->getColumnMeta(0));
var_dump($st->getColumnMeta(2));
var_dump($st->getColumnMeta(1000000));

Resulted in this output:

array(4) { ... }                                   // colno 0
PDOException: SQLSTATE[07009]: invalid column index   // colno 2..1024, raised only after the OOB read
<access violation, exit code 0xC0000005>              // colno 1000000

But I expected this output instead: the same invalid column index error for every out-of-range index, decided before the driver indexes sqlvar[].

Suggested fix: add if (colno < 0 || colno >= stmt->column_count) return FAILURE; in the Firebird driver (or move the upper-bound check before the dispatch in pdo_stmt.c). No existing pdo_firebird test calls getColumnMeta().

PHP Version

PHP 8.7.0-dev (cli) (built: Oct 27 2026 17:51:17) (ZTS Visual C++ 2026 x64)
Zend Engine v4.7.0-dev (master @ 0af8a091eec28513a6a0b758bcb10b430ba6c6de)
Firebird 4.0.7 client, embedded mode

Operating System

Windows 11 x64