Skip to content

pgsql: restore binary-safe pg_lo_write() - #23649

Open
iliaal wants to merge 1 commit into
php:PHP-8.5from
iliaal:fix/aph-puj-lowrite-nul-85
Open

pgsql: restore binary-safe pg_lo_write()#23649
iliaal wants to merge 1 commit into
php:PHP-8.5from
iliaal:fix/aph-puj-lowrite-nul-85

Conversation

@iliaal

@iliaal iliaal commented Sep 10, 2026

Copy link
Copy Markdown
Member

pg_lo_write started rejecting payloads with embedded NUL after its data argument was switched to PATH parsing. The argument is a normal string again so binary large-object writes match 8.4. Path and SQL-identifier parameters from that same conversion are unchanged.

Comment on lines +21 to +28
} catch (ValueError $e) {
echo $e::class, ": ", $e->getMessage(), "\n";
}
try {
pg_lo_write($handle, "abc", 4);
} catch (ValueError $e) {
echo $e::class, ": ", $e->getMessage(), "\n";
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
} catch (ValueError $e) {
echo $e::class, ": ", $e->getMessage(), "\n";
}
try {
pg_lo_write($handle, "abc", 4);
} catch (ValueError $e) {
echo $e::class, ": ", $e->getMessage(), "\n";
}
} catch (Throwable $e) {
echo $e::class, ": ", $e->getMessage(), "\n";
}
try {
pg_lo_write($handle, "abc", 4);
} catch (Throwable $e) {
echo $e::class, ": ", $e->getMessage(), "\n";
}

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

catch (Throwable $e)

Both throw from zend_argument_value_error(), and ext/pgsql tests catch the specific type nearly everywhere. Keeping ValueError.

The conversion of the data parameter to Z_PARAM_PATH_STR() made
pg_lo_write() reject any data containing a null byte, breaking writes of
arbitrary binary payloads which were accepted before. Accept embedded
null bytes again by parsing the data as a length-aware string.
Sibling audit: the other Z_PARAM_PATH* conversions from the same change
(pg_connect(), pg_lo_import(), table/statement identifiers) operate on
paths or SQL text where null-byte rejection is intentional.
@iliaal
iliaal force-pushed the fix/aph-puj-lowrite-nul-85 branch from 67ae8ff to ba1d0a5 Compare September 11, 2026 10:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants