Fix GH-22667: pdo_odbc heap over-read on oversized column value

odbc_stmt_describe() binds a colsize+1 buffer for short columns and stores
that capacity in datalen, but odbc_stmt_get_col() built the result string
from the driver-reported fetched_len. A conforming driver truncates an
over-long value into the buffer yet reports the full length, so
ZVAL_STRINGL_FAST over-read past the allocation and returned adjacent heap to
userland. Clamp fetched_len to the bound capacity, guarded by !is_long so the
long-column SQLGetData path (whose fixed buffer is unrelated to datalen) is
left untouched.

Fixes GH-22667

Author: iliaal

NEWS

@@ -43,6 +43,8 @@ PHP                                                                        NEWS
 - PDO_ODBC:
   . Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN
     carries no credentials). (iliaal)
+  . Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
+    driver-reported display size). (iliaal)
 
 - Phar:
   . Fixed inconsistent handling of the magic ".phar" directory. Paths such as

ext/pdo_odbc/odbc_stmt.c

@@ -744,7 +744,14 @@ static int odbc_stmt_get_col(pdo_stmt_t *stmt, int colno, zval *result, enum pdo
 		return 1;
 	} else if (C->fetched_len >= 0) {
 		/* it was stored perfectly */
-		ZVAL_STRINGL_FAST(result, C->data, C->fetched_len);
+		SQLLEN data_len = C->fetched_len;
+		if (!C->is_long) {
+			SQLLEN max_len = C->is_unicode ? (SQLLEN)C->datalen + 1 : (SQLLEN)C->datalen;
+			if (data_len > max_len) {
+				data_len = max_len;
+			}
+		}
+		ZVAL_STRINGL_FAST(result, C->data, data_len);
 		if (C->is_unicode) {
 			goto unicode_conv;
 		}

ext/pdo_odbc/tests/gh22667.phpt

@@ -0,0 +1,35 @@
+--TEST--
+GH-22667 (Heap buffer over-read when a column value exceeds the bound buffer)
+--EXTENSIONS--
+pdo_odbc
+--SKIPIF--
+<?php
+$file = tempnam(sys_get_temp_dir(), "gh22667");
+try {
+    $pdo = new PDO("odbc:Driver=SQLite3;Database=$file");
+} catch (PDOException $e) {
+    @unlink($file);
+    die("skip requires the SQLite3 ODBC driver");
+}
+?>
+--FILE--
+<?php
+$file = tempnam(sys_get_temp_dir(), "gh22667");
+$pdo = new PDO("odbc:Driver=SQLite3;Database=$file");
+
+// The SQLite3 driver reports a 255 byte display size for a computed column, so
+// the short-bound buffer holds at most 255 bytes while the value is far longer.
+// A conforming driver truncates into the buffer but reports the full length; the
+// returned string must stay within the buffer, not over-read past it.
+$stmt = $pdo->query("SELECT printf('%.*c', 4096, 'A') AS data");
+$row = $stmt->fetch(PDO::FETCH_ASSOC);
+$s = $row['data'];
+
+echo "clamped to buffer: "; var_dump(strlen($s) < 4096);
+echo "only value bytes:  "; var_dump(strlen($s) === substr_count($s, 'A'));
+
+@unlink($file);
+?>
+--EXPECT--
+clamped to buffer: bool(true)
+only value bytes:  bool(true)