Signed integer overflow when setting ATTR_TIMEOUT

[YuanchengJiang]

Description

The following code:

<?php
$pdo = new PDO("sqlite:".__DIR__."/foo.db");
var_dump($pdo->setAttribute(PDO::NULL_TO_STRING, PHP_INT_MIN));

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/ext/pdo_sqlite/sqlite_driver.c:304:37: runtime error: signed integer overflow: -9223372036854775808 * 1000 cannot be represented in type 'long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/pdo_sqlite/sqlite_driver.c:304

PHP Version

nightly

Operating System

No response

[cmb69]

Possible fix (full BC for negative numbers; only fails for large positive values):

 ext/pdo_sqlite/sqlite_driver.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ext/pdo_sqlite/sqlite_driver.c b/ext/pdo_sqlite/sqlite_driver.c
index 708abe444c..2f2bef2c96 100644
--- a/ext/pdo_sqlite/sqlite_driver.c
+++ b/ext/pdo_sqlite/sqlite_driver.c
@@ -301,6 +301,10 @@ static bool pdo_sqlite_set_attr(pdo_dbh_t *dbh, zend_long attr, zval *val)
 			if (!pdo_get_long_param(&lval, val)) {
 				return false;
 			}
+			if (lval > INT_MAX / 1000) {
+				return false;
+			}
+			lval = MAX(lval, 0);
 			sqlite3_busy_timeout(H->db, lval * 1000);
 			return true;
 		case PDO_SQLITE_ATTR_EXTENDED_RESULT_CODES:

See https://www.sqlite.org/c3ref/busy_timeout.html.

[nielsdos]

@cmb69 Your patch looks right to me; I'd say feel free to PR this. I wonder if we should warn in that case to notify the user that no timeout actually was applied.