Fixed bug #35797 (segfault on PDOStatement::execute() with

zend.ze1_compatibility_mode = On).

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index b3363d1a521e3f29d97e98b5030329ce96b471d4..0eec9cb0108885ccfa0e327590c5851e9923a2ad 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2006,6 +2006,34 @@ static int dbstmt_compare(zval *object1, zval *object2 TSRMLS_DC)
        return -1;
 }
 
+static zend_object_value dbstmt_clone_obj(zval *zobject TSRMLS_DC)
+{
+       zend_object_value retval;
+       zval *tmp;
+       pdo_stmt_t *stmt;
+       pdo_stmt_t *old_stmt;
+       zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
+
+       stmt = ecalloc(1, sizeof(*stmt));
+       stmt->ce = Z_OBJCE_P(zobject);
+       stmt->refcount = 1;
+       ALLOC_HASHTABLE(stmt->properties);
+       zend_hash_init(stmt->properties, 0, NULL, ZVAL_PTR_DTOR, 0);
+       zend_hash_copy(stmt->properties, &stmt->ce->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+
+       old_stmt = (pdo_stmt_t *)zend_object_store_get_object(zobject TSRMLS_CC);
+       
+       retval.handle = zend_objects_store_put(stmt, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t)pdo_dbstmt_free_storage, (zend_objects_store_clone_t)dbstmt_clone_obj TSRMLS_CC);
+       retval.handlers = Z_OBJ_HT_P(zobject);
+
+       zend_objects_clone_members((zend_object *)stmt, retval, (zend_object *)old_stmt, handle TSRMLS_CC);
+       
+       zend_objects_store_add_ref(&old_stmt->database_object_handle TSRMLS_CC);
+       stmt->database_object_handle = old_stmt->database_object_handle;
+                       
+       return retval;
+}
+
 zend_object_handlers pdo_dbstmt_object_handlers;
 
 void pdo_stmt_init(TSRMLS_D)
@@ -2024,6 +2052,7 @@ void pdo_stmt_init(TSRMLS_D)
        pdo_dbstmt_object_handlers.unset_property = dbstmt_prop_delete;
        pdo_dbstmt_object_handlers.get_method = dbstmt_method_get;
        pdo_dbstmt_object_handlers.compare_objects = dbstmt_compare;
+       pdo_dbstmt_object_handlers.clone_obj = dbstmt_clone_obj;
 
        INIT_CLASS_ENTRY(ce, "PDORow", pdo_row_functions);
        pdo_row_ce = zend_register_internal_class(&ce TSRMLS_CC);
@@ -2108,7 +2137,7 @@ zend_object_value pdo_dbstmt_new(zend_class_entry *ce TSRMLS_DC)
        zend_hash_init(stmt->properties, 0, NULL, ZVAL_PTR_DTOR, 0);
        zend_hash_copy(stmt->properties, &ce->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 
-       retval.handle = zend_objects_store_put(stmt, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t)pdo_dbstmt_free_storage, NULL TSRMLS_CC);
+       retval.handle = zend_objects_store_put(stmt, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t)pdo_dbstmt_free_storage, (zend_objects_store_clone_t)dbstmt_clone_obj TSRMLS_CC);
        retval.handlers = &pdo_dbstmt_object_handlers;
 
        return retval;