From 13954e66b7650c293d1f8c9d044ed6327b1892d5 Mon Sep 17 00:00:00 2001
From: lacatoire <la.catoire@gmail.com>
Date: Thu, 12 Nov 2026 09:04:41 +0100
Subject: [PATCH 1/2] ext/pgsql: fix the wrong names in the pg_lo_write() and
 pg_lo_read() errors

pg_lo_write() referred to a nonexistent $buf parameter; it is $data.
pg_lo_read() was the only check worded "greater or equal than".
---
 ext/pgsql/pgsql.c                             |  4 +-
 ext/pgsql/tests/pg_lo_error_message_text.phpt | 37 +++++++++++++++++++
 ext/pgsql/tests/pg_lo_write_null_bytes.phpt   |  2 +-
 3 files changed, 40 insertions(+), 3 deletions(-)
 create mode 100644 ext/pgsql/tests/pg_lo_error_message_text.phpt

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 2eb2d6b306e7..64d3b61d18df 100644
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -2785,7 +2785,7 @@ PHP_FUNCTION(pg_lo_read)
 	CHECK_PGSQL_LOB(pgsql);
 
 	if (buffer_length < 0) {
-		zend_argument_value_error(2, "must be greater or equal than 0");
+		zend_argument_value_error(2, "must be greater than or equal to 0");
 		RETURN_THROWS();
 	}
 
@@ -2825,7 +2825,7 @@ PHP_FUNCTION(pg_lo_write)
 			RETURN_THROWS();
 		}
 		if (z_len > (zend_long)ZSTR_LEN(str)) {
-			zend_argument_value_error(3, "must be less than or equal to the length of argument #2 ($buf)");
+			zend_argument_value_error(3, "must be less than or equal to the length of argument #2 ($data)");
 			RETURN_THROWS();
 		}
 		len = z_len;
diff --git a/ext/pgsql/tests/pg_lo_error_message_text.phpt b/ext/pgsql/tests/pg_lo_error_message_text.phpt
new file mode 100644
index 000000000000..a07df7d10f54
--- /dev/null
+++ b/ext/pgsql/tests/pg_lo_error_message_text.phpt
@@ -0,0 +1,37 @@
+--TEST--
+The large object diagnostics name real parameters
+--EXTENSIONS--
+pgsql
+--SKIPIF--
+<?php include("inc/skipif.inc"); ?>
+--FILE--
+<?php
+
+include('inc/config.inc');
+
+$db = pg_connect($conn_str);
+
+pg_query($db, "BEGIN");
+$oid = pg_lo_create($db);
+$lob = pg_lo_open($db, $oid, "w");
+pg_lo_write($lob, "hi");
+
+try {
+    pg_lo_write($lob, "hi", 100);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+
+try {
+    pg_lo_read($lob, -1);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+
+pg_lo_close($lob);
+pg_lo_unlink($db, $oid);
+pg_query($db, "COMMIT");
+?>
+--EXPECT--
+pg_lo_write(): Argument #3 ($length) must be less than or equal to the length of argument #2 ($data)
+pg_lo_read(): Argument #2 ($length) must be greater than or equal to 0
diff --git a/ext/pgsql/tests/pg_lo_write_null_bytes.phpt b/ext/pgsql/tests/pg_lo_write_null_bytes.phpt
index 44073692a182..d58a47d02728 100644
--- a/ext/pgsql/tests/pg_lo_write_null_bytes.phpt
+++ b/ext/pgsql/tests/pg_lo_write_null_bytes.phpt
@@ -45,5 +45,5 @@ int(4)
 int(2)
 int(0)
 ValueError: pg_lo_write(): Argument #3 ($length) must be greater than or equal to 0
-ValueError: pg_lo_write(): Argument #3 ($length) must be less than or equal to the length of argument #2 ($buf)
+ValueError: pg_lo_write(): Argument #3 ($length) must be less than or equal to the length of argument #2 ($data)
 string(6) "780079"

From fe48be83919db9380669da5230a410c55f2638f8 Mon Sep 17 00:00:00 2001
From: lacatoire <la.catoire@gmail.com>
Date: Thu, 12 Nov 2026 14:48:39 +0100
Subject: [PATCH 2/2] ext/pgsql: move the pg_lo_read() check into
 pg_lo_write_null_bytes.phpt

---
 ext/pgsql/tests/pg_lo_error_message_text.phpt | 37 -------------------
 ext/pgsql/tests/pg_lo_write_null_bytes.phpt   |  6 +++
 2 files changed, 6 insertions(+), 37 deletions(-)
 delete mode 100644 ext/pgsql/tests/pg_lo_error_message_text.phpt

diff --git a/ext/pgsql/tests/pg_lo_error_message_text.phpt b/ext/pgsql/tests/pg_lo_error_message_text.phpt
deleted file mode 100644
index a07df7d10f54..000000000000
--- a/ext/pgsql/tests/pg_lo_error_message_text.phpt
+++ /dev/null
@@ -1,37 +0,0 @@
---TEST--
-The large object diagnostics name real parameters
---EXTENSIONS--
-pgsql
---SKIPIF--
-<?php include("inc/skipif.inc"); ?>
---FILE--
-<?php
-
-include('inc/config.inc');
-
-$db = pg_connect($conn_str);
-
-pg_query($db, "BEGIN");
-$oid = pg_lo_create($db);
-$lob = pg_lo_open($db, $oid, "w");
-pg_lo_write($lob, "hi");
-
-try {
-    pg_lo_write($lob, "hi", 100);
-} catch (ValueError $e) {
-    echo $e->getMessage(), "\n";
-}
-
-try {
-    pg_lo_read($lob, -1);
-} catch (ValueError $e) {
-    echo $e->getMessage(), "\n";
-}
-
-pg_lo_close($lob);
-pg_lo_unlink($db, $oid);
-pg_query($db, "COMMIT");
-?>
---EXPECT--
-pg_lo_write(): Argument #3 ($length) must be less than or equal to the length of argument #2 ($data)
-pg_lo_read(): Argument #2 ($length) must be greater than or equal to 0
diff --git a/ext/pgsql/tests/pg_lo_write_null_bytes.phpt b/ext/pgsql/tests/pg_lo_write_null_bytes.phpt
index d58a47d02728..681669895b89 100644
--- a/ext/pgsql/tests/pg_lo_write_null_bytes.phpt
+++ b/ext/pgsql/tests/pg_lo_write_null_bytes.phpt
@@ -36,6 +36,11 @@ pg_lo_write($handle, "x\0y");
 pg_lo_close($handle);
 $handle = pg_lo_open($db, $oid, "r");
 var_dump(bin2hex(pg_lo_read($handle)));
+try {
+    pg_lo_read($handle, -1);
+} catch (Throwable $e) {
+    echo $e::class, ": ", $e->getMessage(), "\n";
+}
 pg_lo_close($handle);
 pg_exec($db, "ROLLBACK");
 ?>
@@ -47,3 +52,4 @@ int(0)
 ValueError: pg_lo_write(): Argument #3 ($length) must be greater than or equal to 0
 ValueError: pg_lo_write(): Argument #3 ($length) must be less than or equal to the length of argument #2 ($data)
 string(6) "780079"
+ValueError: pg_lo_read(): Argument #2 ($length) must be greater than or equal to 0