Skip to content

Commit d4f840f

Browse files
yitamyitam
authored
Initialize output param buffer when allocating extra space (#907)
1 parent e30ebfa commit d4f840f

File tree

3 files changed

+162
-6
lines changed

3 files changed

+162
-6
lines changed

‎source/shared/core_stmt.cpp

+5-6
Original file line numberDiff line numberDiff line change
@@ -2770,10 +2770,10 @@ void resize_output_buffer_if_necessary( _Inout_ sqlsrv_stmt* stmt, _Inout_ zval*
27702770
{
27712771
SQLSRV_ASSERT( column_size != SQLSRV_UNKNOWN_SIZE, "column size should be set to a known value." );
27722772
buffer_len = Z_STRLEN_P( param_z );
2773+
SQLLEN original_len = buffer_len;
27732774
SQLLEN expected_len;
27742775
SQLLEN buffer_null_extra;
27752776
SQLLEN elem_size;
2776-
SQLLEN without_null_len;
27772777

27782778
// calculate the size of each 'element' represented by column_size. WCHAR is of course 2,
27792779
// as is a n(var)char/ntext field being returned as a binary field.
@@ -2801,9 +2801,6 @@ void resize_output_buffer_if_necessary( _Inout_ sqlsrv_stmt* stmt, _Inout_ zval*
28012801
// binary fields aren't null terminated, so we need to account for that in our buffer length calcuations
28022802
buffer_null_extra = (c_type == SQL_C_BINARY) ? elem_size : 0;
28032803

2804-
// this is the size of the string for Zend and for the StrLen parameter to SQLBindParameter
2805-
without_null_len = field_size * elem_size;
2806-
28072804
// increment to include the null terminator since the Zend length doesn't include the null terminator
28082805
buffer_len += elem_size;
28092806

@@ -2821,8 +2818,10 @@ void resize_output_buffer_if_necessary( _Inout_ sqlsrv_stmt* stmt, _Inout_ zval*
28212818
// A zval string len doesn't include the null. This calculates the length it should be
28222819
// regardless of whether the ODBC type contains the NULL or not.
28232820

2824-
// null terminate the string to avoid a warning in debug PHP builds
2825-
ZSTR_VAL(param_z_string)[without_null_len] = '\0';
2821+
// initialize the newly allocated space
2822+
char *p = ZSTR_VAL(param_z_string);
2823+
p = p + original_len;
2824+
memset(p, '\0', expected_len - original_len);
28262825
ZVAL_NEW_STR(param_z, param_z_string);
28272826

28282827
// buffer_len is the length passed to SQLBindParameter. It must contain the space for NULL in the

‎test/functional/pdo_sqlsrv/pdo_900_output_param_memory_data.phpt

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
--TEST--
2+
GitHub issue 900 - output parameter displays data from memory when not finalized
3+
--DESCRIPTION--
4+
This test verifies that when there is an active resultset and output parameter not finalized, it should not show any data from client memory. This test does not work with AlwaysEncrypted because the output param is not assigned in the stored procedure.
5+
--ENV--
6+
PHPT_EXEC=true
7+
--SKIPIF--
8+
<?php require('skipif_mid-refactor.inc'); ?>
9+
--FILE--
10+
<?php
11+
require_once("MsSetup.inc");
12+
require_once("MsCommon_mid-refactor.inc");
13+
14+
function getOutputParam($conn, $storedProcName, $dataType, $inout)
15+
{
16+
$size = rand(1000, 4000); // The maximum anticipated size is 8000 for wide chars
17+
18+
try {
19+
$output = null;
20+
$stmt = $conn->prepare("$storedProcName @OUTPUT = :output");
21+
if ($inout) {
22+
$paramType = PDO::PARAM_STR | PDO::PARAM_INPUT_OUTPUT;
23+
} else {
24+
$paramType = PDO::PARAM_STR;
25+
}
26+
$stmt->bindParam('output', $output, $paramType, $size);
27+
28+
$stmt->execute();
29+
30+
// The output param should be doubled in size for wide characters.
31+
// However, it should not contain any data so after trimming it
32+
// should be merely an empty string because it was originally set to null
33+
$len = strlen($output);
34+
$result = trim($output);
35+
36+
if ($len != ($size * 2) || $result !== "" ) {
37+
echo "Unexpected output param for $dataType: ";
38+
var_dump($output);
39+
}
40+
41+
$stmt->closeCursor();
42+
if (!is_null($output)) {
43+
echo "Output param should be null when finalized!";
44+
}
45+
unset($stmt);
46+
} catch (PdoException $e) {
47+
echo $e->getMessage() . PHP_EOL;
48+
}
49+
}
50+
51+
try {
52+
// This helper method sets PDO::ATTR_ERRMODE to PDO::ERRMODE_EXCEPTION
53+
// $conn = connect();
54+
$conn = new PDO( "sqlsrv:server=$server; Database = $databaseName", $uid, $pwd);
55+
$conn->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
56+
57+
$dataTypes = array("VARCHAR(256)", "VARCHAR(512)", "VARCHAR(max)", "NVARCHAR(256)", "NVARCHAR(512)", "NVARCHAR(max)");
58+
for ($i = 0, $p = 3; $i < count($dataTypes); $i++, $p++) {
59+
// Create the stored procedure first
60+
$storedProcName = "spNullOutputParam" . $i;
61+
$procArgs = "@OUTPUT $dataTypes[$i] OUTPUT";
62+
$procCode = "SELECT 1, 2, 3";
63+
64+
createProc($conn, $storedProcName, $procArgs, $procCode);
65+
getOutputParam($conn, $storedProcName, $dataTypes[$i], false);
66+
getOutputParam($conn, $storedProcName, $dataTypes[$i], true);
67+
68+
// Drop the stored procedure
69+
dropProc($conn, $storedProcName);
70+
}
71+
72+
echo "Done\n";
73+
74+
unset($conn);
75+
} catch (PdoException $e) {
76+
echo $e->getMessage() . PHP_EOL;
77+
}
78+
?>
79+
--EXPECT--
80+
Done

‎test/functional/sqlsrv/sqlsrv_900_output_param_memory_data.phpt

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
--TEST--
2+
GitHub issue 900 - output parameter displays data from memory when not finalized
3+
--DESCRIPTION--
4+
This test verifies that when there is an active resultset and output parameter not finalized, it should not show any data from client memory. This test does not work with AlwaysEncrypted because the output param is not assigned in the stored procedure.
5+
--ENV--
6+
PHPT_EXEC=true
7+
--SKIPIF--
8+
<?php require('skipif_versions_old.inc'); ?>
9+
--FILE--
10+
<?php
11+
require_once('MsCommon.inc');
12+
13+
function getOutputParam($conn, $storedProcName, $inout, $isVarchar)
14+
{
15+
$size = rand(1000, 4000); // The maximum anticipated size is 8000 for wide chars
16+
17+
$output = null;
18+
$dir = ($inout)? SQLSRV_PARAM_INOUT : SQLSRV_PARAM_OUT;
19+
$dataType = ($isVarchar)? "SQLSRV_SQLTYPE_VARCHAR" : "SQLSRV_SQLTYPE_NVARCHAR";
20+
$sqlType = call_user_func($dataType, $size);
21+
22+
$stmt = sqlsrv_prepare($conn, "$storedProcName @OUTPUT = ?", array(array(&$output, $dir, null, $sqlType)));
23+
if (!$stmt) {
24+
fatalError("getOutputParam: failed when preparing to call $storedProcName");
25+
}
26+
if (!sqlsrv_execute($stmt)) {
27+
fatalError("getOutputParam: failed to execute procedure $storedProcName");
28+
}
29+
30+
// The output param should be doubled in size for wide characters.
31+
// However, it should not contain any data so after trimming it
32+
// should be merely an empty string because it was originally set to null
33+
$len = strlen($output);
34+
$expectedLen = $size * 2;
35+
$result = trim($output);
36+
37+
if ($len != $expectedLen || $result !== "" ) {
38+
echo "Unexpected output param for $dataType, $isMax: ";
39+
var_dump($output);
40+
}
41+
42+
sqlsrv_next_result($stmt);
43+
if (!is_null($output)) {
44+
echo "Output param should be null when finalized!";
45+
}
46+
}
47+
48+
set_time_limit(0);
49+
sqlsrv_configure('WarningsReturnAsErrors', 1);
50+
51+
$conn = connect(array("CharacterSet" => "UTF-8"));
52+
if (!$conn) {
53+
fatalError("Could not connect.\n");
54+
}
55+
56+
$dataTypes = array("VARCHAR(256)", "VARCHAR(512)", "VARCHAR(max)", "NVARCHAR(256)", "NVARCHAR(512)", "NVARCHAR(max)");
57+
for ($i = 0, $p = 3; $i < count($dataTypes); $i++, $p++) {
58+
// Create the stored procedure first
59+
$storedProcName = "spNullOutputParam" . $i;
60+
$procArgs = "@OUTPUT $dataTypes[$i] OUTPUT";
61+
$procCode = "SELECT 1, 2, 3";
62+
63+
createProc($conn, $storedProcName, $procArgs, $procCode);
64+
getOutputParam($conn, $storedProcName, false, ($i < 3));
65+
getOutputParam($conn, $storedProcName, true, ($i < 3));
66+
67+
// Drop the stored procedure
68+
dropProc($conn, $storedProcName);
69+
}
70+
71+
echo "Done\n";
72+
73+
sqlsrv_close($conn);
74+
75+
?>
76+
--EXPECT--
77+
Done

0 commit comments

Comments
 (0)