- Improved fix

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index bfdd026cdab81212b8bee8ad017c173d8b1db679..e8dd0f70e9eaf41b9ac0b1f4e8b138c334249a43 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2623,11 +2623,8 @@ static zval *row_prop_or_dim_read(zval *object, zval *member, int type TSRMLS_DC
        pdo_stmt_t * stmt = (pdo_stmt_t *) zend_object_store_get_object(object TSRMLS_CC);
        int colno = -1;
 
-       if ((Z_TYPE_P(member) == IS_STRING || Z_TYPE_P(member) == IS_UNICODE) &&
-               memcmp(Z_UNIVAL_P(member).v, "queryString", sizeof("queryString")-1)) {
-               return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
-       }
        MAKE_STD_ZVAL(return_value);
+       RETVAL_NULL();
                
        if (Z_TYPE_P(member) == IS_LONG) {
                if (Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count) {
@@ -2640,9 +2637,14 @@ static zval *row_prop_or_dim_read(zval *object, zval *member, int type TSRMLS_DC
                for (colno = 0; colno < stmt->column_count; colno++) {
                        if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
                                fetch_value(stmt, return_value, colno, NULL TSRMLS_CC);
-                               break;
+                               Z_SET_REFCOUNT_P(return_value, 0);
+                               Z_UNSET_ISREF_P(return_value);
+                               return return_value;
                        }
                }
+               if (strcmp(Z_STRVAL_P(member), "queryString") == 0) {
+                       return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
+               }
        }
 
        Z_SET_REFCOUNT_P(return_value, 0);

diff --git a/ext/pdo_sqlite/tests/bug44327_3.phpt b/ext/pdo_sqlite/tests/bug44327_3.phpt
new file mode 100644 (file)
index 0000000..4d704c3
--- /dev/null
+++ b/ext/pdo_sqlite/tests/bug44327_3.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #44327.3 (PDORow::queryString property & numeric offsets / Crash)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_sqlite')) print 'skip not loaded';
+?>
+--FILE--
+<?php
+
+$db = new pdo('sqlite:memory');
+
+$x = $db->query('select 1 as queryStringxx');
+$y = $x->fetch(PDO::FETCH_LAZY);
+var_dump($y, $y->queryString, $y->queryStringzz, $y->queryStringxx);
+
+print "---\n";
+
+var_dump($y[5], $y->{3});
+
+?>
+--EXPECTF--
+object(PDORow)#%d (2) {
+  ["queryString"]=>
+  string(25) "select 1 as queryStringxx"
+  ["queryStringxx"]=>
+  string(1) "1"
+}
+string(25) "select 1 as queryStringxx"
+NULL
+string(1) "1"
+---
+NULL
+NULL