Repository navigation
Fix GH-20726: crash in pdo_odbc with pooling and no credentials - #22512
Merged
NattyNarwhal merged 1 commit intoJun 30, 2026
Merged
Conversation
This was referenced Jun 29, 2026
NattyNarwhal
approved these changes
Jun 29, 2026
NattyNarwhal
left a comment
Member
There was a problem hiding this comment.
Maybe add a comment explaining why in source, but looks OK. We should also file upstream to unixODBC too...
When a DSN carries no credentials, dbh->username and dbh->password are NULL. With ODBC connection pooling enabled, the unixODBC driver manager compares the cached and requested credentials with strcmp() while matching a pooled connection, dereferencing the NULL pointers and crashing inside SQLConnect. Pass empty strings instead. This hardens the connect path; the pooling use-after-free in phpGH-20726 is a separate unixODBC defect.
iliaal
force-pushed
the
fix/gh-20726-pdo-odbc-null-creds
branch
from
June 29, 2026 23:27
13e1da3 to
a5a9e9e
Compare
Member
Author
|
Added the comment and PR for upstream lib as well. |
NattyNarwhal
approved these changes
Jun 30, 2026
pull Bot
pushed a commit
to edisplay/php-src
that referenced
this pull request
Jun 30, 2026
* PHP-8.4: Fix phpGH-20726: crash in pdo_odbc with pooling and no credentials (php#22512)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pdo_odbc passed dbh->username and dbh->password straight to SQLConnect, and both are NULL when the DSN carries no credentials. With ODBC connection pooling enabled, the unixODBC driver manager runs strcmp() on the cached and requested credentials while matching a pooled connection, dereferences the NULL, and crashes inside SQLConnect. Passing empty strings avoids it. Reproduced on PHP-8.4 against the MDBTools driver with pooling enabled: a connect/close loop SIGSEGVs unpatched and runs clean patched. This hardens the PHP side only; the residual fault under pooling is an uninitialised-value read inside unixODBC's own pool bookkeeping and belongs upstream. Refs #20726