Bug #66311 [NEW]: Stack smashing protection kills PDO/ODBC queries

From: michael at orlitzky dot com Operating system: Gentoo Linux PHP version: master-Git-2013-12-17 (Git) Package: PDO related Bug Type: Bug Bug description:Stack smashing protection kills PDO/ODBC queries Description: ------------ The background and test code for the issue can be found at, https://bugs.gentoo.org/show_bug.cgi?id=491100 In ext/pdo_odbc/odbc_stmt.c, there is a function odbc_stmt_describe which declares variables, SDWORD colsize, displaysize; Later the displaysize variable is filled via a call to SQLColAttribute: rc = SQLColAttribute(S->stmt, colno+1, SQL_DESC_DISPLAY_SIZE, NULL, 0, NULL, &displaysize); According to /usr/include/sqlucode.h, the final parameter to SQLColAttribute should be of type SQLLEN instead of SDWORD. When displaysize's value is finally used, colsize = displaysize; col->maxlen = S->cols[colno].datalen = colsize; The stack smashing protection kicks in due to the mismatched types, and the program segfaults. Replacing the SDWORD type with SQLLEN avoids the issue (although there are other type warnings in the same file). -- Edit bug report at https://bugs.php.net/bug.php?id=66311&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66311&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66311&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66311&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66311&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66311&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66311&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66311&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66311&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66311&r=support Expected behavior: https://bugs.php.net/fix.php?id=66311&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66311&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66311&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66311&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66311&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66311&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66311&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66311&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66311&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66311&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66311&r=mysqlcfg