Commit 0c11f486d7e for php.net

commit 0c11f486d7e423967f29a2a9e56968e9a95cb92e
Merge: 3583a7b8bdb 8e4daeff7a3
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Tue Jul 14 15:29:36 2026 -0400

    Merge branch 'PHP-8.4' into PHP-8.5

    * PHP-8.4:
      Fix GH-22668: odbc heap over-read on oversized column value

diff --cc NEWS
index de82bc685da,a9ad00c2be6..2c88dee0b23
--- a/NEWS
+++ b/NEWS
@@@ -40,15 -30,18 +40,19 @@@ PH
    . Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc
      alignment). (iliaal)

 -- Intl:
 -  . Fixed Locale::lookup() and locale_lookup() to return NULL instead of the
 -    fallback locale when a language tag cannot be canonicalized. (Weilin Du)
 -  . Fixed memory leaks when calling Collator::__construct() or
 -    Spoofchecker::__construct() twice. (Weilin Du)
 -  . Fixed IntlChar methods leaving stale global error state after successful
 -    calls. (Xuyang Zhang)
 -
+ - ODBC:
+   . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
+     driver-reported display size). (iliaal)
+
 +- Opcache:
 +  . Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler
 +    through the wrong run_time_cache slot on megamorphic calls). (ptondereau,
 +    iliaal)
 +  . Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from
 +    an undereferenced run_time_cache map_ptr offset). (iliaal)
 +  . Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache
 +    preloaded trait). (iliaal)
 +
  - OpenSSL:
    . Fixed timeout for supplemental read at end of a blocking stream in SSL
      stream wrapper. (ilutov)
diff --cc ext/odbc/php_odbc.c
index 7a6bc287182,16617078d3c..e75d11b554b
--- a/ext/odbc/php_odbc.c
+++ b/ext/odbc/php_odbc.c
@@@ -669,13 -679,14 +669,14 @@@ void odbc_bindcols(odbc_result *result
  	result->binmode = ODBCG(defaultbinmode);

  	for(i = 0; i < result->numcols; i++) {
 -		charextraalloc = 0;
 +		bool char_extra_alloc = false;
+ 		result->values[i].value_max_len = 0;
  		colfieldid = SQL_COLUMN_DISPLAY_SIZE;

 -		rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), PHP_ODBC_SQL_DESC_NAME,
 +		rc = SQLColAttribute(result->stmt, (SQLUSMALLINT)(i+1), SQL_DESC_NAME,
  				result->values[i].name, sizeof(result->values[i].name), &colnamelen, 0);
  		result->values[i].coltype = 0;
 -		rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_TYPE,
 +		rc = SQLColAttribute(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_TYPE,
  				NULL, 0, NULL, &result->values[i].coltype);

  		/* Don't bind LONG / BINARY columns, so that fetch behaviour can