From 4551d07feb0add7e93ba5c415f2e73960542422b Mon Sep 17 00:00:00 2001 From: David Carlier Date: Thu, 15 Jan 2026 23:05:18 +0000 Subject: [PATCH] exp/pgsql: insert/update query string build possible UB fix. From PQescapeIdentifier() docs ``` A terminating zero byte is not required, and should not be counted in length ``` --- ext/pgsql/pgsql.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c index 1fbda456c3bbe..80aacd5443eaa 100644 --- a/ext/pgsql/pgsql.c +++ b/ext/pgsql/pgsql.c @@ -5632,7 +5632,7 @@ PHP_PGSQL_API zend_result php_pgsql_insert(PGconn *pg_link, const zend_string *t goto cleanup; } if (opt & PGSQL_DML_ESCAPE) { - tmp = PQescapeIdentifier(pg_link, ZSTR_VAL(fld), ZSTR_LEN(fld) + 1); + tmp = PQescapeIdentifier(pg_link, ZSTR_VAL(fld), ZSTR_LEN(fld)); if (tmp == NULL) { php_error_docref(NULL, E_NOTICE, "Failed to escape field '%s'", ZSTR_VAL(fld)); goto cleanup; @@ -5817,7 +5817,7 @@ static inline int build_assignment_string(PGconn *pg_link, smart_str *querystr, return -1; } if (opt & PGSQL_DML_ESCAPE) { - char *tmp = PQescapeIdentifier(pg_link, ZSTR_VAL(fld), ZSTR_LEN(fld) + 1); + char *tmp = PQescapeIdentifier(pg_link, ZSTR_VAL(fld), ZSTR_LEN(fld)); if (tmp == NULL) { php_error_docref(NULL, E_NOTICE, "Failed to escape field '%s'", ZSTR_VAL(fld)); return -1;