Merge branch 'PHP-8.4' into PHP-8.5

iliaal · iliaal · commit 92c179e640e4 · 2026-06-30T07:36:58.000-04:00
* PHP-8.4: Fix phpGH-20726: crash in pdo_odbc with pooling and no credentials (php#22512)
diff --git a/NEWS b/NEWS
@@ -32,6 +32,10 @@ PHP                                                                        NEWS
 - Lexbor:
   . Merge patch c3a6847. (ilutov, timwolla)
 
+- PDO_ODBC:
+  . Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN
+    carries no credentials). (iliaal)
+
 - Phar:
   . Fixed inconsistent handling of the magic ".phar" directory. Paths such as
     "/.phar" remain protected, while non-magic paths that merely start with
diff --git a/ext/pdo_odbc/odbc_driver.c b/ext/pdo_odbc/odbc_driver.c
@@ -605,7 +605,11 @@ static int pdo_odbc_handle_factory(pdo_dbh_t *dbh, zval *driver_options) /* {{{
 				dsnbuf, sizeof(dsnbuf)-1, &dsnbuflen, SQL_DRIVER_NOPROMPT);
 	}
 	if (!use_direct) {
-		rc = SQLConnect(H->dbc, (SQLCHAR *) dbh->data_source, SQL_NTS, (SQLCHAR *) dbh->username, SQL_NTS, (SQLCHAR *) dbh->password, SQL_NTS);
+		/* unixODBC pooling strcmp()s the credentials when matching a cached
+		 * connection and crashes on a NULL username/password, so pass "". */
+		rc = SQLConnect(H->dbc, (SQLCHAR *) dbh->data_source, SQL_NTS,
+			(SQLCHAR *) (dbh->username ? dbh->username : ""), SQL_NTS,
+			(SQLCHAR *) (dbh->password ? dbh->password : ""), SQL_NTS);
 	}
 
 	if (rc != SQL_SUCCESS && rc != SQL_SUCCESS_WITH_INFO) {

Original file line number	Diff line number	Diff line change
`@@ -605,7 +605,11 @@ static int pdo_odbc_handle_factory(pdo_dbh_t dbh, zval driver_options) /* {{{`
`605`	`605`	`dsnbuf, sizeof(dsnbuf)-1, &dsnbuflen, SQL_DRIVER_NOPROMPT);`
`606`	`606`	`}`
`607`	`607`	`if (!use_direct) {`
`608`		`- rc = SQLConnect(H->dbc, (SQLCHAR ) dbh->data_source, SQL_NTS, (SQLCHAR ) dbh->username, SQL_NTS, (SQLCHAR *) dbh->password, SQL_NTS);`
	`608`	`+ /* unixODBC pooling strcmp()s the credentials when matching a cached`
	`609`	`+ * connection and crashes on a NULL username/password, so pass "". */`
	`610`	`+ rc = SQLConnect(H->dbc, (SQLCHAR *) dbh->data_source, SQL_NTS,`
	`611`	`+ (SQLCHAR *) (dbh->username ? dbh->username : ""), SQL_NTS,`
	`612`	`+ (SQLCHAR *) (dbh->password ? dbh->password : ""), SQL_NTS);`
`609`	`613`	`}`
`610`	`614`
`611`	`615`	`if (rc != SQL_SUCCESS && rc != SQL_SUCCESS_WITH_INFO) {`