throw on null bytes / resolve GH-13952

ext/pdo_sqlite/sqlite_driver.c

@@ -28,6 +28,7 @@
 #include "zend_exceptions.h"
 #include "sqlite_driver_arginfo.h"
 
+
 int _pdo_sqlite_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, const char *file, int line) /* {{{ */
 {
 	pdo_sqlite_db_handle *H = (pdo_sqlite_db_handle *)dbh->driver_data;
@@ -73,7 +74,6 @@ int _pdo_sqlite_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, const char *file, int li
 			strncpy(*pdo_err, "HY000", sizeof(*pdo_err));
 			break;
 	}
-
 	if (!dbh->methods) {
 		pdo_throw_exception(einfo->errcode, einfo->errmsg, pdo_err);
 	}
@@ -226,6 +226,15 @@ static zend_string* sqlite_handle_quoter(pdo_dbh_t *dbh, const zend_string *unqu
 	if (ZSTR_LEN(unquoted) > (INT_MAX - 3) / 2) {
 		return NULL;
 	}
+	if(memchr(ZSTR_VAL(unquoted), '\0', ZSTR_LEN(unquoted)) != NULL) {
+		if (dbh->error_mode == PDO_ERRMODE_EXCEPTION) {
+			zend_throw_exception_ex(php_pdo_get_exception(), 0,
+				"SQLite PDO::quote does not support NULL bytes");
+		} else if (dbh->error_mode == PDO_ERRMODE_WARNING) {
+			php_error_docref(NULL, E_WARNING, "SQLite PDO::quote does not support NULL bytes");
+		}
+		return NULL;
+	}
 	quoted = safe_emalloc(2, ZSTR_LEN(unquoted), 3);
 	/* TODO use %Q format? */
 	sqlite3_snprintf(2*ZSTR_LEN(unquoted) + 3, quoted, "'%q'", ZSTR_VAL(unquoted));
@@ -837,6 +846,8 @@ static int pdo_sqlite_handle_factory(pdo_dbh_t *dbh, zval *driver_options) /* {{
 	if (driver_options) {
 		timeout = pdo_attr_lval(driver_options, PDO_ATTR_TIMEOUT, timeout);
 	}
+
+
 	sqlite3_busy_timeout(H->db, timeout * 1000);
 
 	dbh->alloc_own_columns = 1;

ext/pdo_sqlite/tests/gh13952.phpt

@@ -0,0 +1,79 @@
+--TEST--
+GH-13952 (sqlite PDO::quote handles null bytes correctly)
+--EXTENSIONS--
+pdo
+pdo_sqlite
+--FILE--
+<?php
+
+$modes = [
+    'exception' => PDO::ERRMODE_EXCEPTION,
+    'warning'   => PDO::ERRMODE_WARNING,
+    'silent'    => PDO::ERRMODE_SILENT,
+];
+
+$test_cases = [
+    "",
+    "x",
+    "\x00",
+    "a\x00b",
+    "\x00\x00\x00",
+    "foobar",
+    "foo'''bar",
+    "'foo'''bar'",
+    "foo\x00bar",
+    "'foo'\x00'bar'",
+    "foo\x00\x00\x00bar",
+    "\x00foo\x00\x00\x00bar\x00",
+    "\x00\x00\x00foo",
+    "foo\x00\x00\x00",
+    "\x80", // << invalid UTF-8
+    "\x00\x80\x00", // << invalid UTF-8 with null bytes
+];
+
+foreach ($modes as $mode_name => $mode) {
+    echo "Testing error mode: $mode_name\n";
+    $db = new PDO('sqlite::memory:', null, null, [PDO::ATTR_ERRMODE => $mode]);
+
+    foreach ($test_cases as $test) {
+        $contains_null = str_contains($test, "\x00");
+
+        if ($mode === PDO::ERRMODE_EXCEPTION && $contains_null) {
+            set_error_handler(fn() => throw new PDOException(), E_WARNING);
+            try {
+                $db->quote($test);
+                throw new LogicException("Expected exception not thrown.");
+            } catch (PDOException) {
+                // expected
+            } finally {
+                restore_error_handler();
+            }
+        } else {
+            set_error_handler(fn() => null, E_WARNING);
+            $quoted = $db->quote($test);
+            restore_error_handler();
+
+            if ($contains_null) {
+                if ($quoted !== false) {
+                    throw new LogicException("Expected false, got: " . var_export($quoted, true));
+                }
+            } else {
+                if ($quoted === false) {
+                    throw new LogicException("Unexpected false from quote().");
+                }
+                $fetched = $db->query("SELECT $quoted")->fetchColumn();
+                if ($fetched !== $test) {
+                    throw new LogicException("Data corrupted: expected " . var_export($test, true) . " got " . var_export($fetched, true));
+                }
+            }
+        }
+    }
+}
+
+echo "ok\n";
+?>
+--EXPECT--
+Testing error mode: exception
+Testing error mode: warning
+Testing error mode: silent
+ok