Skip to content

[PDO] Return false from rewrite_name_to_position() on IM001 error path - #283

Closed
iliaal wants to merge 5 commits into
PHP-8.4from
fix/pdo-rewrite-name-im001-84
Closed

[PDO] Return false from rewrite_name_to_position() on IM001 error path#283
iliaal wants to merge 5 commits into
PHP-8.4from
fix/pdo-rewrite-name-im001-84

Conversation

@iliaal

@iliaal iliaal commented Aug 24, 2026

Copy link
Copy Markdown
Owner

rewrite_name_to_position() is declared bool, so the -1 returned after raising the IM001 error for a repeated :named parameter was converted to true and the caller's failure check in dispatch_param_event() never saw the failure. This changes the return to false so the error propagates correctly. Sibling audit found no other -1 return in this function or its call sites.

lazerg and others added 3 commits August 24, 2026 16:57
sapi_cli_server_send_headers() sent the header buffer through
php_cli_server_client_send_through() but dropped the return value, so it
always reported SAPI_HEADER_SENT_SUCCESSFULLY, even when the send failed
and php_handle_aborted_connection() did not bail out (ignore_user_abort=1).
It now compares the send result against the buffer length and returns
SAPI_HEADER_SEND_FAILED when it comes up short.

php_cli_server_client_send_through() itself returned the number of bytes
left on failure, which equals str_len when nothing was sent: the same
value it returns on success. It now returns the number of bytes actually
sent on both paths.

Since sapi_send_headers() resets headers_sent on SAPI_HEADER_SEND_FAILED,
a headers_written flag on the client guards against rebuilding and
resending the whole header block on every subsequent output write.

Close phpGH-23428
…ams (php#23282)

Keep the native archive state alive independently of the ZipArchive object,
allowing streams to remain valid without retaining the object itself.
@iliaal iliaal closed this Aug 24, 2026
@iliaal iliaal reopened this Aug 24, 2026
iliaal added 2 commits August 25, 2026 18:18
uloc_getKeywordValue failure destroyed the result array and returned
without uenum_close(). Close the enumeration on that path. The success
path already closes it.

Audited the other uenum_close site in this file (acceptLanguage).

Closes phpGH-23351
rewrite_name_to_position() returns bool, so the previous -1 was
converted to true and the caller's failure check never triggered after
raising the IM001 error for a repeated named parameter, leaving
bindParam()/bindColumn() reporting success. Sibling audit: no other -1
return remains in this function; the other error paths already return 0.
@iliaal
iliaal force-pushed the fix/pdo-rewrite-name-im001-84 branch from 049f8f5 to f451d5a Compare August 25, 2026 23:17
@iliaal

iliaal commented Aug 25, 2026

Copy link
Copy Markdown
Owner Author

Promoted as php#23465.

@iliaal iliaal closed this Aug 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants