@@ -6171,6 +6171,7 @@ static void _php_db2_bind_fetch_helper(INTERNAL_FUNCTION_PARAMETERS, int op)
61716171 unsigned char * out_ptr ;
61726172 int i5trim = 0 ;
61736173 int i5char ;
6174+ size_t string_length ;
61746175 if (zend_parse_parameters (argc , "r|l" , & stmt , & row_number ) == FAILURE ) {
61756176 return ;
61766177 }
@@ -6287,9 +6288,20 @@ static void _php_db2_bind_fetch_helper(INTERNAL_FUNCTION_PARAMETERS, int op)
62876288 case SQL_DECIMAL :
62886289 case SQL_NUMERIC :
62896290 case SQL_DECFLOAT :
6291+ /* CB20251003: Sometimes SQL/CLI (at least on IBM i) may
6292+ * return junk at the end of a buffer. If that's the case,
6293+ * we should trust out_length. However, it seems we do want
6294+ * to truncate at the first nul character like strlen does,
6295+ * (see tests/test_6572_SQLStringsContNULLChar.phpt), so
6296+ * pick the lower number between the two. Alternatively,
6297+ * maybe we could consider changing the behaviour around
6298+ * nul characters? It would make sense for binaries...
6299+ */
6300+ string_length = strlen ((char * )row_data -> str_val );
6301+ string_length = out_length < string_length ? out_length : string_length ;
62906302#ifdef PASE /* i5/OS trim spaces */
62916303 if (stmt_res -> s_i5_conn_parent -> c_i5_char_trim > 0 ) {
6292- i5trim = strlen (( char * ) row_data -> str_val ) ;
6304+ i5trim = string_length ;
62936305 for (; i5trim >= 0 ; i5trim -- ) {
62946306 i5char = (char )(((char * )row_data -> str_val )[i5trim ]);
62956307 if (i5char == 0x00 || i5char == 0x20 ) {
@@ -6316,11 +6328,11 @@ static void _php_db2_bind_fetch_helper(INTERNAL_FUNCTION_PARAMETERS, int op)
63166328#endif /* PASE */
63176329 if ( op & DB2_FETCH_ASSOC ) {
63186330 add_assoc_stringl (return_value , (char * )stmt_res -> column_info [i ].name ,
6319- (char * )row_data -> str_val , strlen (( char * ) row_data -> str_val ) );
6331+ (char * )row_data -> str_val , string_length );
63206332 }
63216333 if ( op & DB2_FETCH_INDEX ) {
63226334 add_index_stringl (return_value , i , (char * )row_data -> str_val ,
6323- strlen (( char * ) row_data -> str_val ) );
6335+ string_length );
63246336 }
63256337 break ;
63266338 case SQL_BOOLEAN :
0 commit comments