ext/pdo: Reject NUL bytes in parameterized SQL

NEWS

@@ -76,6 +76,8 @@ PHP                                                                        NEWS
     column index. (Ilia Alshanetsky)
   . Fixed PDOStatement::bindColumn() registering a binding for a column name
     that is not in the result set. (Ilia Alshanetsky)
+  . Reject SQL queries containing NUL bytes during parameter parsing.
+    (Ilia Alshanetsky)
 
 - Readline:
   . Fixed a heap over-read in the interactive shell prompt when cli.prompt is

ext/pdo/pdo_sql_parser.re

@@ -76,6 +76,11 @@ PDO_API int pdo_parse_params(pdo_stmt_t *stmt, zend_string *inquery, zend_string
 	int (*scan)(pdo_scanner_t *s);
 	struct custom_quote custom_quote = {NULL, 0};
 
+	if (memchr(ZSTR_VAL(inquery), '\0', ZSTR_LEN(inquery))) {
+		pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "SQL query must not contain NUL bytes");
+		return -1;
+	}
+
 	scan = stmt->dbh->methods->scanner ? stmt->dbh->methods->scanner : default_scanner;
 
 	s.cur = ZSTR_VAL(inquery);

ext/pdo_odbc/tests/nul_query_params.phpt

@@ -0,0 +1,31 @@
+--TEST--
+PDO ODBC rejects NUL bytes before rewriting SQL parameters
+--EXTENSIONS--
+pdo_odbc
+--SKIPIF--
+<?php
+require __DIR__ . '/config.inc';
+try {
+    new PDO(PDO_ODBC_SQLITE_DSN);
+} catch (PDOException $e) {
+    die("skip requires the SQLite3 ODBC driver");
+}
+?>
+--FILE--
+<?php
+require __DIR__ . '/config.inc';
+$pdo = new PDO(PDO_ODBC_SQLITE_DSN);
+
+foreach (["SELECT 1\0, :value", "SELECT :value\0, 2"] as $query) {
+    try {
+        $pdo->prepare($query);
+        echo "NUL accepted\n";
+    } catch (PDOException $e) {
+        echo $e::class, ": ", $e->getCode(), ": ",
+            str_contains($e->getMessage(), 'NUL byte') ? 'NUL byte' : $e->getMessage(), "\n";
+    }
+}
+?>
+--EXPECT--
+PDOException: HY000: NUL byte
+PDOException: HY000: NUL byte