MFB: Fixed bug #37445 (Fixed crash in pdo_mysql resulting from premature

object destruction).

diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c
index bb5a65353f9634db44e9c2641ccbdc2584c34ef0..a76dfc49e6061a1d4afd55f73b7e5040d2700d28 100755 (executable)
--- a/ext/pdo/pdo_dbh.c
+++ b/ext/pdo/pdo_dbh.c
@@ -575,6 +575,7 @@ static PHP_METHOD(PDO, prepare)
        stmt->dbh = dbh;
        /* give it a reference to me */
        zend_objects_store_add_ref(getThis() TSRMLS_CC);
+       php_pdo_dbh_addref(dbh TSRMLS_CC);
        stmt->database_object_handle = *getThis();
        /* we haven't created a lazy object yet */
        ZVAL_NULL(&stmt->lazy_object_ref);
@@ -1013,6 +1014,7 @@ static PHP_METHOD(PDO, query)
        stmt->dbh = dbh;
        /* give it a reference to me */
        zend_objects_store_add_ref(getThis() TSRMLS_CC);
+       php_pdo_dbh_addref(dbh TSRMLS_CC);
        stmt->database_object_handle = *getThis();
        /* we haven't created a lazy object yet */
        ZVAL_NULL(&stmt->lazy_object_ref);

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index edd48e4b2769e83977db43cefca7a5aa82d63c81..46d02b108e00a13eaa946a2f2242448a4e736c64 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2154,6 +2154,7 @@ static void free_statement(pdo_stmt_t *stmt TSRMLS_DC)
        do_fetch_opt_finish(stmt, 1 TSRMLS_CC);
 
        zend_objects_store_del_ref(&stmt->database_object_handle TSRMLS_CC);
+       php_pdo_dbh_delref(stmt->dbh TSRMLS_CC);
        efree(stmt);
 }
 

diff --git a/ext/pdo_mysql/tests/bug_37445.phpt b/ext/pdo_mysql/tests/bug_37445.phpt
new file mode 100644 (file)
index 0000000..c4d7600
--- /dev/null
+++ b/ext/pdo_mysql/tests/bug_37445.phpt
@@ -0,0 +1,21 @@
+--TEST--
+PDO MySQL Bug #37445 (Premature stmt object destruction) 
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo') || !extension_loaded('pdo_mysql')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+
+$db->setAttribute(PDO :: ATTR_EMULATE_PREPARES, true);
+$stmt = $db->prepare("SELECT 1");
+$stmt->bindParam(':a', 'b');
+
+--EXPECTF--
+Fatal error: Cannot pass parameter 2 by reference in %s/bug_37445.php on line %d
\ No newline at end of file