fix segfault on re-binding and re-executing a statement

improve the test
patch by Chris Jones

diff --git a/ext/oci8/oci8_statement.c b/ext/oci8/oci8_statement.c
index f0a6d5e3da34bb00eb5358a4bf8bae9d28a962b8..6621cc72928d3696de62fba6ba1d939c59424641 100644 (file)
--- a/ext/oci8/oci8_statement.c
+++ b/ext/oci8/oci8_statement.c
@@ -1147,7 +1147,17 @@ sb4 php_oci_bind_out_callback(
        
        phpbind->out = 1; /* mark as OUT bind */
 
-       if ((Z_TYPE_P(val) == IS_OBJECT) || (Z_TYPE_P(val) == IS_RESOURCE)) {
+       if (Z_TYPE_P(val) == IS_RESOURCE) {
+               retval = OCI_CONTINUE;
+       } else if (Z_TYPE_P(val) == IS_OBJECT) {
+               if (!phpbind->descriptor) {
+                       return OCI_ERROR;
+               }
+               *alenpp = &phpbind->dummy_len;
+               *bufpp = phpbind->descriptor;
+               *piecep = OCI_ONE_PIECE;
+               *rcodepp = &phpbind->retcode;
+               *indpp = &phpbind->indicator;
                retval = OCI_CONTINUE;
        } else { 
                if (UG(unicode)) {

diff --git a/ext/oci8/php_oci8_int.h b/ext/oci8/php_oci8_int.h
index 2c28295e7a2e5775f58277ca80d96d1b3ccfe172..6d10ab10aa634bdcb7128f42fecef0c18be565f2 100644 (file)
--- a/ext/oci8/php_oci8_int.h
+++ b/ext/oci8/php_oci8_int.h
@@ -199,6 +199,7 @@ typedef struct { /* php_oci_bind {{{ */
        sb2 indicator;                  /* -1 means NULL */
        ub2 retcode;                    /*  */
        zend_bool out;                  /* OUT bind or not */
+       ub4 dummy_len;                  /* a dummy var to store alenpp value in bind OUT callback */
 } php_oci_bind; /* }}} */
 
 typedef struct { /* php_oci_out_column {{{ */

diff --git a/ext/oci8/tests/oci_execute_segfault.phpt b/ext/oci8/tests/oci_execute_segfault.phpt
index 3859f4ffe023d1a79cbadbd1644ce03a67e52573..9e4e23b202a4c882a03bed3884ee0c1e6da7ca9c 100644 (file)
--- a/ext/oci8/tests/oci_execute_segfault.phpt
+++ b/ext/oci8/tests/oci_execute_segfault.phpt
@@ -1,30 +1,54 @@
 --TEST--
-oci_execute() segfault after repeated bind
+oci_execute() segfault after repeated bind of LOB descriptor
 --SKIPIF--
 <?php if (!extension_loaded('oci8')) die("skip no oci8 extension"); ?>
 --FILE--
 <?php
-       
+
 require dirname(__FILE__).'/connect.inc';
 require dirname(__FILE__).'/create_table.inc';
 
 $ora_sql = "INSERT INTO
-                       ".$table_name." (blob, clob)
+                       ".$schema.$table_name." (blob, clob)
                       VALUES (empty_blob(), empty_clob())
                       RETURNING
-                               blob
-                      INTO :v_blob ";
+                               clob
+                      INTO :v_clob ";
+
+$s = oci_parse($c, $ora_sql);
+$clob = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($s, ":v_clob", $clob, -1, OCI_B_CLOB);
+oci_execute($s, OCI_DEFAULT);
+var_dump($clob->save("some text data"));
+
+oci_bind_by_name($s, ":v_clob", $clob, -1, OCI_B_CLOB);
+oci_execute($s, OCI_DEFAULT);
+var_dump($clob->save("some more text data"));
 
-$s = oci_parse($c,$ora_sql);
-$blob = oci_new_descriptor($c,OCI_D_LOB);
-oci_bind_by_name($s,":v_blob", $blob,-1,OCI_B_BLOB);
-oci_execute($s);
+$query = 'SELECT clob, DBMS_LOB.GETLENGTH(clob) FROM '.$schema.$table_name.' ORDER BY 2';
 
-oci_bind_by_name($s,":v_blob", $blob,-1,OCI_B_BLOB);
-oci_execute($s);
+$s = oci_parse ($c, $query);
+oci_execute($s, OCI_DEFAULT);
+
+while ($arr = oci_fetch_assoc($s)) {
+    $result = $arr['CLOB']->load();
+    var_dump($result);
+}
+
+require dirname(__FILE__).'/drop_table.inc';
 
 echo "Done\n";
 
 ?>
 --EXPECT--
+bool(true)
+bool(true)
+string(14) "some text data"
+string(19) "some more text data"
+Done
+--UEXPECT--
+bool(true)
+bool(true)
+unicode(14) "some text data"
+unicode(19) "some more text data"
 Done