diff --git a/ext/pdo_sqlite/sqlite_driver.c b/ext/pdo_sqlite/sqlite_driver.c index c933c34ed1dcd..48b0115413989 100644 --- a/ext/pdo_sqlite/sqlite_driver.c +++ b/ext/pdo_sqlite/sqlite_driver.c @@ -292,6 +292,10 @@ static bool pdo_sqlite_set_attr(pdo_dbh_t *dbh, zend_long attr, zval *val) if (!pdo_get_long_param(&lval, val)) { return false; } + if (lval > INT_MAX / 1000) { + return false; + } + lval = MAX(lval, 0); sqlite3_busy_timeout(H->db, lval * 1000); return true; case PDO_SQLITE_ATTR_EXTENDED_RESULT_CODES: diff --git a/ext/pdo_sqlite/tests/gh17746.phpt b/ext/pdo_sqlite/tests/gh17746.phpt new file mode 100644 index 0000000000000..3ece7a73a5ea2 --- /dev/null +++ b/ext/pdo_sqlite/tests/gh17746.phpt @@ -0,0 +1,15 @@ +--TEST-- +GH-17746 (Signed integer overflow when setting ATTR_TIMEOUT) +--EXTENSIONS-- +pdo_sqlite +--CREDITS-- +YuanchengJiang +--FILE-- +setAttribute(PDO::ATTR_TIMEOUT, -1)); +var_dump($pdo->setAttribute(PDO::ATTR_TIMEOUT, intdiv(0x7fffffff, 1000) + 1)); +?> +--EXPECT-- +bool(true) +bool(false)