Merge branch 'PHP-8.5'

* PHP-8.5:
  ext/pdo: Bound-check column index in getColumnMeta()

Author: iliaal

NEWS

@@ -33,6 +33,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in
     a truncated UTF-8 sequence). (Lazizbek Ergashev)
 
+- PDO:
+  . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
+    column index. (Ilia Alshanetsky)
+
 - PGSQL:
   . Fixed pg_lo_write() rejecting data containing null bytes. (Ilia Alshanetsky)
 

ext/pdo/pdo_stmt.c

@@ -1586,6 +1586,13 @@ PHP_METHOD(PDOStatement, getColumnMeta)
 		RETURN_FALSE;
 	}
 
+	if (stmt->columns == NULL || colno >= stmt->column_count) {
+		zval_ptr_dtor(return_value);
+		ZVAL_UNDEF(return_value);
+		pdo_raise_impl_error(stmt->dbh, stmt, "07009", "invalid column index");
+		RETURN_FALSE;
+	}
+
 	/* add stock items */
 	col = &stmt->columns[colno];
 	add_assoc_str(return_value, "name", zend_string_copy(col->name));

ext/pdo_odbc/tests/getcolumnmeta_bounds.phpt

@@ -0,0 +1,49 @@
+--TEST--
+PDO_odbc getColumnMeta() bounds checking on unexecuted statements and invalid indexes
+--EXTENSIONS--
+pdo_odbc
+--SKIPIF--
+<?php
+try {
+    new Pdo\Odbc('odbc:Driver={SQLite3};Database=:memory:');
+} catch (Throwable $e) {
+    die('skip SQLite3 ODBC driver not available');
+}
+?>
+--FILE--
+<?php
+$pdo = new Pdo\Odbc('odbc:Driver={SQLite3};Database=:memory:',
+    null, null, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
+$stmt = $pdo->prepare('SELECT 1 AS one');
+
+try {
+    var_dump($stmt->getColumnMeta(0));
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+$stmt->execute();
+var_dump($stmt->getColumnMeta(0));
+
+try {
+    var_dump($stmt->getColumnMeta(5));
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
+}
+
+echo "done\n";
+?>
+--EXPECTF--
+PDOException: SQLSTATE[07009]: Invalid descriptor index: invalid column index
+array(4) {
+  ["pdo_type"]=>
+  int(2)
+  ["name"]=>
+  string(3) "one"
+  ["len"]=>
+  int(%d)
+  ["precision"]=>
+  int(%d)
+}
+PDOException: SQLSTATE[07009]: Invalid descriptor index: invalid column index
+done