1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
--TEST--
Bug #81720 (Uninitialized array in pg_query_params() leading to RCE)
--EXTENSIONS--
pgsql
--SKIPIF--
<?php include("inc/skipif.inc"); ?>
--FILE--
<?php
include('inc/config.inc');
$conn = pg_connect($conn_str);
try {
pg_query_params($conn, 'SELECT $1, $2', [1, new stdClass()]);
} catch (Throwable $ex) {
echo $ex->getMessage(), PHP_EOL;
}
try {
pg_send_prepare($conn, "my_query", 'SELECT $1, $2');
pg_get_result($conn);
pg_send_execute($conn, "my_query", [1, new stdClass()]);
} catch (Throwable $ex) {
echo $ex->getMessage(), PHP_EOL;
}
?>
--EXPECT--
Object of class stdClass could not be converted to string
Object of class stdClass could not be converted to string
|
