Skip to content

Fix binary parameter truncation at embedded NUL in PDO emulated prepares (CWE-626) - #1675

Merged
jahnvi480 merged 1 commit into
devfrom
jahnvi/fix-msrc-125656-binary-quote-truncation
Jul 22, 2026
Merged

Fix binary parameter truncation at embedded NUL in PDO emulated prepares (CWE-626)#1675
jahnvi480 merged 1 commit into
devfrom
jahnvi/fix-msrc-125656-binary-quote-truncation

Conversation

@jahnvi480

Copy link
Copy Markdown
Contributor

pdo_sqlsrv_dbh_quote hex-encoded binary parameters but stopped at the first NUL byte, silently truncating data bound with SQLSRV_ENCODING_BINARY under emulated prepares. Encode the full length in both PHP version paths and add a regression test. (MSRC 125656)

…res (CWE-626)

pdo_sqlsrv_dbh_quote hex-encoded binary parameters but stopped at the first NUL byte, silently truncating data bound with SQLSRV_ENCODING_BINARY under emulated prepares. Encode the full length in both PHP version paths and add a regression test. (MSRC 125656)
@codecov

codecov Bot commented Jul 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.80%. Comparing base (3341925) to head (1b84c85).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##              dev    #1675   +/-   ##
=======================================
  Coverage   85.80%   85.80%           
=======================================
  Files          23       23           
  Lines        7251     7251           
=======================================
  Hits         6222     6222           
  Misses       1029     1029           
Files with missing lines Coverage Δ
source/pdo_sqlsrv/pdo_dbh.cpp 91.36% <100.00%> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@jahnvi480
jahnvi480 merged commit 983cea9 into dev Jul 22, 2026
15 checks passed
@David-Engel David-Engel added the PR: Product fix only PR that includes only code changes to the product to fix an issue. No API changes. label Jul 24, 2026
@David-Engel David-Engel modified the milestones: 5.14.0-beta1, 5.13.2 Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

PR: Product fix only PR that includes only code changes to the product to fix an issue. No API changes.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants