Description:
------------
Hello PHP team,

in PHP_FUNCTION(pg_query_params), the array meant to store the char* representation of the query parameters is allocated on the heap, but not cleared:

```
params = (char **)safe_emalloc(sizeof(char *), num_params, 0);
```

If a conversion error happens (for instance, one of the params is an object), `_php_pgsql_free_params()` gets called *on the whole array*. Since the array is not initialized, a lingering value from a previous request can get freed, leading in the end to remote code execution.

To patch, use calloc or memset-0 it.

There are other functions where you use basically the same code (if cannot convert to string, then free all params) so it might be worth a look.

Patch: 

```
- _php_pgsql_free_params(params, num_params);
+ _php_pgsql_free_params(params, i);
```

Best regards,
Charles Fol
ambionics.io


Test script:
---------------
<?php

$strings = [];

function uenc($v)
{
    $out = '';
    for($i=0; $i<strlen($v);$i++)
    {
        $out .= '\u' . '00' . str_pad(dechex(ord($v[$i])), 2, '0', STR_PAD_LEFT);
    }
    return '"' . $out . '"';
}

$json = 
    '{"a": 1, "args":[
        "A","A","A",
        {}
    ]}'
;
$c = pg_connect('host=172.17.0.3 user=postgres password=password');

$data = json_decode($json);

$resultXXX = pg_query_params($c, 'SELECT * FROM test WHERE x NOT IN ($1)', $data->args);
// var_dump(pg_fetch_all($resultXXX));

Expected result:
----------------
No crash.

Actual result:
--------------
Crash.