Skip to content

Fix large int corruption to/from pdo_sqlite UDF #25058

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mvorisek wants to merge 3 commits into from
Closed

Fix large int corruption to/from pdo_sqlite UDF #25058

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
802f51b
Fix large int corruption to/from pdo_sqlite UDF
mvorisek Oct 30, 2026
a006132
address review
mvorisek Oct 30, 2026
cba861a
merge PHP 8.4
mvorisek Oct 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions ext/pdo_sqlite/sqlite_driver.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,7 +355,11 @@ static int do_callback(zend_fcall_info_cache *fcc, int argc, sqlite3_value **arg
/* get the value */
switch (sqlite3_value_type(argv[i])) {
case SQLITE_INTEGER:
#ifdef ZEND_ENABLE_ZVAL_LONG64
ZVAL_LONG(&zargs[i + is_agg], sqlite3_value_int64(argv[i]));
#else
ZVAL_LONG(&zargs[i + is_agg], sqlite3_value_int(argv[i]));
#endif
break;

case SQLITE_FLOAT:
Expand Down Expand Up @@ -393,7 +397,11 @@ static int do_callback(zend_fcall_info_cache *fcc, int argc, sqlite3_value **arg
if (!Z_ISUNDEF(retval)) {
switch (Z_TYPE(retval)) {
case IS_LONG:
#ifdef ZEND_ENABLE_ZVAL_LONG64
sqlite3_result_int64(context, Z_LVAL(retval));
#else
sqlite3_result_int(context, Z_LVAL(retval));
#endif
break;

case IS_NULL:
Expand Down
2 changes: 1 addition & 1 deletion ext/pdo_sqlite/sqlite_statement.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@ static int pdo_sqlite_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_d
}
} else {
convert_to_long(parameter);
#if ZEND_LONG_MAX > 2147483647
#ifdef ZEND_ENABLE_ZVAL_LONG64
if (SQLITE_OK == sqlite3_bind_int64(S->stmt, param->paramno + 1, Z_LVAL_P(parameter))) {
return 1;
}
Expand Down
28 changes: 28 additions & 0 deletions ext/pdo_sqlite/tests/gh25021-udf.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
--TEST--
GH-25021 (UDF isn't using sqlite3_*_int64 API)
--EXTENSIONS--
pdo_sqlite
--FILE--
<?php

$conn = new PDO('sqlite::memory:');

$conn->sqliteCreateFunction('my_udf_pass_int', static fn(int $v): int => $v);

foreach ([
10,
PHP_INT_MIN,
PHP_INT_MAX,
] as $v) {
$stmt = $conn->prepare('select my_udf_pass_int(:v)');
$stmt->bindValue(':v', $v, PDO::PARAM_INT);
$stmt->execute();
$result = $stmt->fetch();

var_dump($result[0] === $v);
}
?>
--EXPECT--
bool(true)
bool(true)
bool(true)
10 changes: 5 additions & 5 deletions ext/sqlite3/sqlite3.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -638,7 +638,7 @@ static void sqlite_value_to_zval(php_sqlite3_db_object *db_obj, sqlite3_stmt *st
switch (sqlite3_column_type(stmt, column)) {
case SQLITE_INTEGER:
val = sqlite3_column_int64(stmt, column);
#if LONG_MAX <= 2147483647
#ifndef ZEND_ENABLE_ZVAL_LONG64
if (val > ZEND_LONG_MAX || val < ZEND_LONG_MIN) {
const char *text = (const char *) sqlite3_column_text(stmt, column);
if (UNEXPECTED(text == NULL)) {
Expand All @@ -650,7 +650,7 @@ static void sqlite_value_to_zval(php_sqlite3_db_object *db_obj, sqlite3_stmt *st
} else {
#endif
ZVAL_LONG(data, (zend_long) val);
#if LONG_MAX <= 2147483647
#ifndef ZEND_ENABLE_ZVAL_LONG64
}
#endif
break;
Expand Down Expand Up @@ -811,7 +811,7 @@ static int sqlite3_do_callback(zend_fcall_info_cache *fcc, uint32_t argc, sqlite
for (i = 0; i < argc; i++) {
switch (sqlite3_value_type(argv[i])) {
case SQLITE_INTEGER:
#if ZEND_LONG_MAX > 2147483647
#ifdef ZEND_ENABLE_ZVAL_LONG64
ZVAL_LONG(&zargs[i + is_agg], sqlite3_value_int64(argv[i]));
#else
ZVAL_LONG(&zargs[i + is_agg], sqlite3_value_int(argv[i]));
Expand Down Expand Up @@ -862,7 +862,7 @@ static int sqlite3_do_callback(zend_fcall_info_cache *fcc, uint32_t argc, sqlite
if (!Z_ISUNDEF(retval)) {
switch (Z_TYPE(retval)) {
case IS_LONG:
#if ZEND_LONG_MAX > 2147483647
#ifdef ZEND_ENABLE_ZVAL_LONG64
sqlite3_result_int64(context, Z_LVAL(retval));
#else
sqlite3_result_int(context, Z_LVAL(retval));
Expand Down Expand Up @@ -1590,7 +1590,7 @@ static int php_sqlite3_bind_params(php_sqlite3_stmt *stmt_obj) /* {{{ */
switch (param->type) {
case SQLITE_INTEGER:
convert_to_long(parameter);
#if ZEND_LONG_MAX > 2147483647
#ifdef ZEND_ENABLE_ZVAL_LONG64
return_code = sqlite3_bind_int64(stmt_obj->stmt, param->param_number, Z_LVAL_P(parameter));
#else
return_code = sqlite3_bind_int(stmt_obj->stmt, param->param_number, Z_LVAL_P(parameter));
Expand Down
27 changes: 27 additions & 0 deletions ext/sqlite3/tests/gh25021-udf.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
--TEST--
GH-25021 (UDF isn't using sqlite3_*_int64 API)
--EXTENSIONS--
sqlite3
--FILE--
<?php

$conn = new SQLite3(':memory:');

$conn->createFunction('my_udf_pass_int', static fn(int $v): int => $v);

foreach ([
10,
PHP_INT_MIN,
PHP_INT_MAX,
] as $v) {
$stmt = $conn->prepare('select my_udf_pass_int(:v)');
$stmt->bindValue(':v', $v, SQLITE3_INTEGER);
$result = $stmt->execute()->fetchArray();

var_dump($result[0] === $v);
}
?>
--EXPECT--
bool(true)
bool(true)
bool(true)
Loading