From f0406255819850b29616b66c77569ebe42ebad74 Mon Sep 17 00:00:00 2001
From: "Min H. Hong" <twotailplatypus@gmail.com>
Date: Mon, 26 Oct 2026 01:38:48 +0900
Subject: [PATCH] fix: one byte heap overflow when a procedure has no
 parameters

parameterString is allocated as parameterCount * 2 bytes, which is zero when callProcedure is given an empty array for a procedure that takes no parameters. The terminator is then written past the end of the allocation. Allocate one extra byte.
---
 src/odbc_connection.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/odbc_connection.cpp b/src/odbc_connection.cpp
index 5486179..784e907 100644
--- a/src/odbc_connection.cpp
+++ b/src/odbc_connection.cpp
@@ -1795,7 +1795,7 @@ class CallProcedureAsyncWorker : public ODBCAsyncWorker {
     // create the statement to call the stored procedure using the ODBC Call
     // escape sequence: need to create the string "?,?,?,?" where the number of
     // '?' is the number of parameters;
-    size_t parameterStringSize = (data->parameterCount * 2);
+    size_t parameterStringSize = (data->parameterCount * 2) + 1;
     char* parameterString = new char[parameterStringSize];
     parameterString[0] = '\0';