ext/pdo: Validate Oracle null handling modes

NEWS

@@ -77,6 +77,8 @@ PHP                                                                        NEWS
     exits). (Lazizbek Ergashev)
 
 - PDO:
+  . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
+    (Ilia Alshanetsky)
   . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a
     persistent connection. (Ilia Alshanetsky)
 

ext/pdo/pdo_dbh.c

@@ -854,9 +854,16 @@ static bool pdo_dbh_attribute_set(pdo_dbh_t *dbh, zend_long attr, zval *value) /
 			if (!pdo_get_long_param(&lval, value)) {
 				return false;
 			}
-			/* TODO Check for valid value (NULL_NATURAL, NULL_EMPTY_STRING, NULL_TO_STRING)? */
-			dbh->oracle_nulls = lval;
-			return true;
+			switch (lval) {
+				case PDO_NULL_NATURAL:
+				case PDO_NULL_EMPTY_STRING:
+				case PDO_NULL_TO_STRING:
+					dbh->oracle_nulls = lval;
+					return true;
+				default:
+					zend_value_error("PDO::ATTR_ORACLE_NULLS must be one of the PDO::NULL_* constants");
+					return false;
+			}
 
 		case PDO_ATTR_DEFAULT_FETCH_MODE:
 			if (Z_TYPE_P(value) == IS_ARRAY) {

ext/pdo/tests/pdo_oracle_nulls_invalid.phpt

@@ -0,0 +1,49 @@
+--TEST--
+PDO Common: Invalid Oracle null handling modes do not change the attribute
+--EXTENSIONS--
+pdo
+--SKIPIF--
+<?php
+$dir = getenv('REDIR_TEST_DIR');
+if ($dir === false) {
+    die('skip no driver');
+}
+require_once $dir . 'pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require_once getenv('REDIR_TEST_DIR') . 'pdo_test.inc';
+$pdo = PDOTest::factory();
+
+foreach ([PDO::NULL_NATURAL, PDO::NULL_EMPTY_STRING, PDO::NULL_TO_STRING] as $value) {
+    echo "Valid mode: ";
+    var_dump($pdo->setAttribute(PDO::ATTR_ORACLE_NULLS, $value));
+    var_dump($pdo->getAttribute(PDO::ATTR_ORACLE_NULLS));
+}
+
+foreach ([-1, 3, 4, PHP_INT_MAX] as $value) {
+    try {
+        $pdo->setAttribute(PDO::ATTR_ORACLE_NULLS, $value);
+    } catch (ValueError $e) {
+        echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+    }
+    echo "Unchanged mode: ";
+    var_dump($pdo->getAttribute(PDO::ATTR_ORACLE_NULLS));
+}
+?>
+--EXPECT--
+Valid mode: bool(true)
+int(0)
+Valid mode: bool(true)
+int(1)
+Valid mode: bool(true)
+int(2)
+ValueError: PDO::ATTR_ORACLE_NULLS must be one of the PDO::NULL_* constants
+Unchanged mode: int(2)
+ValueError: PDO::ATTR_ORACLE_NULLS must be one of the PDO::NULL_* constants
+Unchanged mode: int(2)
+ValueError: PDO::ATTR_ORACLE_NULLS must be one of the PDO::NULL_* constants
+Unchanged mode: int(2)
+ValueError: PDO::ATTR_ORACLE_NULLS must be one of the PDO::NULL_* constants
+Unchanged mode: int(2)