php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #44362 fetchAll(PDO::FETCH_COLUMN|<other>, ...) and column index -1/PHP_INT_MAX + 1
Submitted: 2008-03-07 12:57 UTC Modified: 2008-03-10 08:13 UTC
From: uwendel at mysql dot com Assigned:
Status: Not a bug Package: PDO related
PHP Version: 5.3CVS-2008-03-07 (CVS) OS:
Private report: No CVE-ID: None
 [2008-03-07 12:57 UTC] uwendel at mysql dot com
Description:
------------
Under certain circumstances  fetchAll  ([ int $fetch_style  [, int $column_index  [, array $ctor_args  ]]] ) seems not to recognize invalid column index specifications. It seems a bit like an INT overflow to me. The issue can be observed when using PDO::FETCH_COLUMN together with another flag like PDO::FETCH_UNIQUE or PDO::FETCH_GROUP.

SELECT id, grp FROM test
-> column indicies are:
   id:  0
   grp: 1

fetchAll(PDO::FETCH_COLUMN, 2)  -> Warning as expected -> OK
fetchAll(PDO::FETCH_COLUMN, -1) -> Warning as expected -> OK

fetchAll(PDO::FETCH_GROUP|PDO::FETCH_COLUMN, -1) -> No warning -> Bug?
fetchAll(PDO::FETCH_GROUP|PDO::FETCH_COLUMN, PHP_INT_MAX + 1) -> No warning -> Bug?
fetchAll(PDO::FETCH_GROUP|PDO::FETCH_COLUMN, 2) -> Warning -> OK


fetchAll(PDO::FETCH_UNIQUE|PDO::FETCH_COLUMN, -1) -> No warning -> Bug?
fetchAll(PDO::FETCH_UNIQUE|PDO::FETCH_COLUMN, PHP_INT_MAX + 1) -> No warning -> Bug?
fetchAll(PDO::FETCH_UNIQUE|PDO::FETCH_COLUMN, 2) -> Warning -> OK



Reproduce code:
---------------
--- example using PDO_MYSQL -------

 sapi/cli/php -r '$db = new PDO("mysql:dbname=phptest;unix_socket=/tmp/mysql.sock", "root", "root"); $db->exec("DROP TABLE test"); $db->exec("CREATE TABLE test (id INT, grp CHAR(1))"); $db->exec("INSERT INTO test(id, grp) VALUES (5, \"A\")"); $db->exec("INSERT INTO test(id, grp) VALUES (6, \"B\")"); $stmt = $db->prepare("SELECT id, grp FROM test ORDER BY id ASC"); $stmt->execute(); var_dump($stmt->fetchAll(PDO::FETCH_COLUMN, -1)); $stmt->execute(); var_dump($stmt->fetchAll(PDO::FETCH_GROUP|PDO::FETCH_COLUMN, -1)); $stmt->execute(); var_dump($stmt->fetchAll(PDO::FETCH_GROUP|PDO::FETCH_COLUMN, PHP_INT_MAX + 1));'

Warning: PDOStatement::fetchAll(): SQLSTATE[HY000]: General error: Invalid column index in Command line code on line 1
array(0) {
}
array(2) {
  [5]=>
  array(1) {
    [0]=>
    string(1) "A"
  }
  [6]=>
  array(1) {
    [0]=>
    string(1) "B"
  }
}
array(2) {
  [5]=>
  array(1) {
    [0]=>
    string(1) "A"
  }
  [6]=>
  array(1) {
    [0]=>
    string(1) "B"
  }
}


---------- example using PDO_SQlite -----------

nixnutz@ulflinux:~/php53_libmysql> sapi/cli/php -r '$db = new PDO("sqlite:/tmp/foo"); $db->exec("DROP TABLE test"); $db->exec("CREATE TABLE test (id INT, grp CHAR(1))"); $db->exec("INSERT INTO test(id, grp) VALUES (5, \"A\")"); $db->exec("INSERT INTO test(id, grp) VALUES (6, \"B\")"); $stmt = $db->prepare("SELECT id, grp FROM test ORDER BY id ASC"); $stmt->execute(); var_dump($stmt->fetchAll(PDO::FETCH_COLUMN, -1)); $stmt->execute(); var_dump($stmt->fetchAll(PDO::FETCH_UNIQUE|PDO::FETCH_COLUMN, -1)); $stmt->execute(); var_dump($stmt->fetchAll(PDO::FETCH_UNIQUE|PDO::FETCH_COLUMN, PHP_INT_MAX + 1)); $stmt->execute(); var_dump($stmt->fetchAll(PDO::FETCH_UNIQUE|PDO::FETCH_COLUMN, 2));'

Warning: PDOStatement::fetchAll(): SQLSTATE[HY000]: General error: Invalid column index in Command line code on line 1
array(0) {
}
array(2) {
  [5]=>
  string(1) "A"
  [6]=>
  string(1) "B"
}
array(2) {
  [5]=>
  string(1) "A"
  [6]=>
  string(1) "B"
}

Warning: PDOStatement::fetchAll(): SQLSTATE[HY000]: General error: Invalid column index in Command line code on line 1
array(0) {
}


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-03-09 17:24 UTC] iliaa@php.net
Negative offsets carry a special meaning in the case of FETCH_GROUP, 
where by the indicate that the data column should be #1
 [2008-03-10 08:13 UTC] uwendel at mysql dot com
One out of four issues explained. Three questions still unsanswered.

The bogus explanation covers:

 fetchAll(PDO::FETCH_GROUP, -1)
 --> (undocumented?) feature

The explanation does not cover:

 fetchAll(PDO::FETCH_UNIQUE, -1) --> (??)
 fetchAll(PDO::FETCH_UNIQUE, PHP_INT_MAX + 1) --> (overflow?)
 fetchAll(PDO::FETCH_GROUP, PHP_INT_MAX + 1) --> (overflow?)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Dec 26 16:01:31 2024 UTC