From 345b88deebf59574023020f5c1feebabfe0767f3 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Fri, 10 Jul 2026 08:32:15 -0400
Subject: [PATCH 1/2] Fix GH-22665: pdo_odbc OOB write on oversized diagnostic
 length

pdo_odbc_error() writes the NUL terminator at
einfo->last_err_msg[errmsgsize], where errmsgsize is the diagnostic length
SQLGetDiagRec reports. On a truncated message (SQL_SUCCESS_WITH_INFO) the
driver reports the full untruncated length, which can reach or exceed the
512-byte buffer, so the terminator lands out of bounds in the adjacent
last_error field. Clamp the index to sizeof(last_err_msg) - 1; the size_t
cast also folds a negative driver-reported length into the same guard.

Fixes GH-22665
Closes GH-22675
---
 NEWS                            |  2 ++
 ext/pdo_odbc/odbc_driver.c      |  2 ++
 ext/pdo_odbc/tests/gh22665.phpt | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 ext/pdo_odbc/tests/gh22665.phpt

diff --git a/NEWS b/NEWS
index 76be38bcaa70..70dd9bce1c48 100644
--- a/NEWS
+++ b/NEWS
@@ -53,6 +53,8 @@ PHP                                                                        NEWS
     driver-reported display size). (iliaal)
   . Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
     longer than the declared maxlen). (iliaal)
+  . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
+    diagnostic message length beyond the error buffer). (iliaal)
 
 - Phar:
   . Fixed inconsistent handling of the magic ".phar" directory. Paths such as
diff --git a/ext/pdo_odbc/odbc_driver.c b/ext/pdo_odbc/odbc_driver.c
index 2cdac30223c0..3bb028ed6314 100644
--- a/ext/pdo_odbc/odbc_driver.c
+++ b/ext/pdo_odbc/odbc_driver.c
@@ -90,6 +90,8 @@ void pdo_odbc_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, PDO_ODBC_HSTMT statement,
 
 	if (rc != SQL_SUCCESS && rc != SQL_SUCCESS_WITH_INFO) {
 		errmsgsize = 0;
+	} else if ((size_t) errmsgsize >= sizeof(einfo->last_err_msg)) {
+		errmsgsize = sizeof(einfo->last_err_msg) - 1;
 	}
 
 	einfo->last_err_msg[errmsgsize] = '\0';
diff --git a/ext/pdo_odbc/tests/gh22665.phpt b/ext/pdo_odbc/tests/gh22665.phpt
new file mode 100644
index 000000000000..d6edc62288e8
--- /dev/null
+++ b/ext/pdo_odbc/tests/gh22665.phpt
@@ -0,0 +1,32 @@
+--TEST--
+GH-22665 (OOB write in pdo_odbc_error when the driver reports a long message)
+--EXTENSIONS--
+pdo_odbc
+--SKIPIF--
+<?php
+require __DIR__ . '/config.inc';
+try {
+    $pdo = new PDO(PDO_ODBC_SQLITE_DSN);
+} catch (PDOException $e) {
+    die("skip requires the SQLite3 ODBC driver");
+}
+?>
+--FILE--
+<?php
+require __DIR__ . '/config.inc';
+$pdo = new PDO(PDO_ODBC_SQLITE_DSN, null, null, [
+    PDO::ATTR_ERRMODE => PDO::ERRMODE_SILENT,
+]);
+
+// A failing query with a long identifier makes the driver report a diagnostic
+// message length >= the fixed last_err_msg buffer. The terminator write must
+// stay inside the buffer.
+$pdo->query('SELECT * FROM "' . str_repeat('A', 4096) . '"');
+$info = $pdo->errorInfo();
+
+echo "sqlstate: ", $info[0], "\n";
+echo "done\n";
+?>
+--EXPECT--
+sqlstate: HY000
+done

From 665bab296553f8d8c224bb9a9518062f1ca819b7 Mon Sep 17 00:00:00 2001
From: Volker Dusch <edorian@php.net>
Date: Wed, 15 Jul 2026 02:18:14 +0200
Subject: [PATCH 2/2] PHP-8.5 is now for PHP 8.5.10-dev

---
 NEWS               | 5 ++++-
 Zend/zend.h        | 2 +-
 configure.ac       | 2 +-
 main/php_version.h | 6 +++---
 4 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/NEWS b/NEWS
index 7e138fcc2bb1..878cf9d5d12e 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,9 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 8.5.9
+?? ??? ????, PHP 8.5.10
+
+
+30 Jul 2026, PHP 8.5.9
 
 - Core:
   . Fixed bug GH-22290 (AST pretty printing does not correctly handle strings
diff --git a/Zend/zend.h b/Zend/zend.h
index 40b3d7825a72..1ae16ee0d6a0 100644
--- a/Zend/zend.h
+++ b/Zend/zend.h
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "4.5.9-dev"
+#define ZEND_VERSION "4.5.10-dev"
 
 #define ZEND_ENGINE_3
 
diff --git a/configure.ac b/configure.ac
index 3ac956d908de..b8e19cc167c7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -17,7 +17,7 @@ dnl Basic autoconf initialization, generation of config.nice.
 dnl ----------------------------------------------------------------------------
 
 AC_PREREQ([2.68])
-AC_INIT([PHP],[8.5.9-dev],[https://github.com/php/php-src/issues],[php],[https://www.php.net])
+AC_INIT([PHP],[8.5.10-dev],[https://github.com/php/php-src/issues],[php],[https://www.php.net])
 AC_CONFIG_SRCDIR([main/php_version.h])
 AC_CONFIG_AUX_DIR([build])
 AC_PRESERVE_HELP_ORDER
diff --git a/main/php_version.h b/main/php_version.h
index 2b4f5a437201..f3eae43fad45 100644
--- a/main/php_version.h
+++ b/main/php_version.h
@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 8
 #define PHP_MINOR_VERSION 5
-#define PHP_RELEASE_VERSION 9
+#define PHP_RELEASE_VERSION 10
 #define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "8.5.9-dev"
-#define PHP_VERSION_ID 80509
+#define PHP_VERSION "8.5.10-dev"
+#define PHP_VERSION_ID 80510