fix bug #38253 (PDO produces segfault with default fetch mode)

add test

diff --git a/NEWS b/NEWS
index e71da9d9b86f7be1b34721ea3671a8dfd02746b5..b39a16eaa5e330be2aec079868e4caa5aa95f3e7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,7 @@ PHP                                                                        NEWS
 - Fixed a bug in the filter extension that prevented magic_quotes_gpc from
   being applied when RAW filter is used. (Ilia)
 - Fixed bug #38255 (openssl possible leaks while passing keys) (Pierre)
+- Fixed bug #38253 (PDO produces segfault with default fetch mode). (Tony)
 - Fixed bug #38236 (Binary data gets corrupted on multipart/formdata POST).
   (Ilia)
 - Fixed bug #38234 (Exception in __clone makes memory leak). (Dmitry, Nuno)

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index de448b6c4f7cdc6ba8dd3ef34eec8bdc4097bec8..057e339f51a2e0cbb860c4a2aa4e8311dd1d156e 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -919,6 +919,10 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
                                        zval_dtor(&val);
                                }
                                ce = stmt->fetch.cls.ce;
+                               if (!ce) {
+                                       pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "No fetch class specified" TSRMLS_CC);
+                                       return 0;
+                               }
                                if ((flags & PDO_FETCH_SERIALIZE) == 0) {
                                        object_init_ex(return_value, ce);
                                        if (!stmt->fetch.cls.fci.size) {
@@ -960,6 +964,10 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
                                break;
 
                        case PDO_FETCH_FUNC:
+                               if (!stmt->fetch.func.function) {
+                                       pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "No fetch function specified" TSRMLS_CC);
+                                       return 0;
+                               }
                                if (!stmt->fetch.func.fci.size) {
                                        if (!do_fetch_func_prepare(stmt TSRMLS_CC))
                                        {

diff --git a/ext/pdo/tests/bug_38253.phpt b/ext/pdo/tests/bug_38253.phpt
new file mode 100644 (file)
index 0000000..713eefb
--- /dev/null
+++ b/ext/pdo/tests/bug_38253.phpt
@@ -0,0 +1,47 @@
+--TEST--
+PDO Common: PHP Bug #38253: PDO produces segfault with default fetch mode
+--SKIPIF--
+<?php # vim:ft=php
+if (!extension_loaded('pdo')) die('skip');
+$dir = getenv('REDIR_TEST_DIR');
+if (false == $dir) die('skip no driver');
+require_once $dir . 'pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+if (getenv('REDIR_TEST_DIR') === false) putenv('REDIR_TEST_DIR='.dirname(__FILE__) . '/../../pdo/tests/');
+require_once getenv('REDIR_TEST_DIR') . 'pdo_test.inc';
+$pdo = PDOTest::factory();
+
+$pdo->exec ("create table test (id integer primary key, n text)");
+$pdo->exec ("INSERT INTO test (n) VALUES ('hi')");
+
+$pdo->setAttribute (PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_CLASS);
+$stmt = $pdo->prepare ("SELECT * FROM test");
+$stmt->execute();
+var_dump($stmt->fetchAll());
+
+$pdo = PDOTest::factory();
+
+$pdo->exec ("create table test2 (id integer primary key, n text)");
+$pdo->exec ("INSERT INTO test2 (n) VALUES ('hi')");
+
+$pdo->setAttribute (PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_FUNC);
+$stmt = $pdo->prepare ("SELECT * FROM test2");
+$stmt->execute();
+var_dump($stmt->fetchAll());
+
+?>
+--EXPECTF--
+Warning: PDOStatement::fetchAll(): SQLSTATE[HY000]: General error: No fetch class specified in %s on line %d
+
+Warning: PDOStatement::fetchAll(): SQLSTATE[HY000]: General error%s on line %d
+array(0) {
+}
+
+Warning: PDOStatement::fetchAll(): SQLSTATE[HY000]: General error: No fetch function specified in %s on line %d
+
+Warning: PDOStatement::fetchAll(): SQLSTATE[HY000]: General error%s on line %d
+array(0) {
+}