Fixed bug #35135 (PDOStatment without related PDO object may crash).

diff --git a/NEWS b/NEWS
index 8bdebda05dc66ab6b9d9ef6ba6ad675ee9355a35..9865e76e6711e990dc5e25df7630aebd30627d48 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,7 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Nov 2005, PHP 5.1
 - Fixed initializing and argument checking for posix_mknod(). (Derick)
+- Fixed bug #35135 (PDOStatment without related PDO object may crash). (Ilia)
 - Fixed bug #35091 (SoapClient leaks memory). (Dmitry)
 - Fixed bug #35078 (configure does not find ldap_start_tls_s). (Jani)
 - Fixed bugs #35022, #35019 (Regression in the behavior of key() and current()

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 41ba56c33c168e65130df74632c90cf9bae993bb..68eec666d59f212c23f6b2ae6067b9b1dadabd4b 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -69,6 +69,12 @@ ZEND_END_ARG_INFO();
 /* }}} */
 #endif
 
+#define PHP_STMT_GET_OBJ       \
+  pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);   \
+  if (!stmt->dbh) {    \
+    RETURN_FALSE;      \
+  }    \
+
 static PHP_FUNCTION(dbstmt_constructor) /* {{{ */
 {
        php_error_docref(NULL TSRMLS_CC, E_ERROR, "You should not create a PDOStatement manually");
@@ -333,9 +339,9 @@ static int really_register_bound_param(struct pdo_bound_param_data *param, pdo_s
    Execute a prepared statement, optionally binding parameters */
 static PHP_METHOD(PDOStatement, execute)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
        zval *input_params = NULL;
        int ret = 1;
+       PHP_STMT_GET_OBJ;
 
        if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|a!", &input_params)) {
                RETURN_FALSE;
@@ -1144,7 +1150,7 @@ static PHP_METHOD(PDOStatement, fetch)
        long how = PDO_FETCH_USE_DEFAULT;
        long ori = PDO_FETCH_ORI_NEXT;
        long off = 0;
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+        PHP_STMT_GET_OBJ;
 
        if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|lll", &how,
                        &ori, &off)) {
@@ -1177,8 +1183,8 @@ static PHP_METHOD(PDOStatement, fetchObject)
        zval *old_ctor_args, *ctor_args;
        int error = 0, old_arg_count;
 
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
-       
+       PHP_STMT_GET_OBJ;
+
        if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sz", 
                &class_name, &class_name_len, &ctor_args)) {
                RETURN_FALSE;
@@ -1245,8 +1251,8 @@ static PHP_METHOD(PDOStatement, fetchObject)
    Returns a data of the specified column in the result set. */
 static PHP_METHOD(PDOStatement, fetchColumn)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
        long col_n = 0;
+       PHP_STMT_GET_OBJ;
 
        if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|l", &col_n)) {
                RETURN_FALSE;
@@ -1267,13 +1273,13 @@ static PHP_METHOD(PDOStatement, fetchColumn)
    Returns an array of all of the results. */
 static PHP_METHOD(PDOStatement, fetchAll)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
        long how = PDO_FETCH_USE_DEFAULT;
        zval *data, *return_all;
        zval *arg2;
        zend_class_entry *old_ce;
        zval *old_ctor_args, *ctor_args = NULL;
        int error = 0, old_arg_count;
+       PHP_STMT_GET_OBJ;         
 
        if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|lzz", &how, &arg2, &ctor_args)) {
                RETURN_FALSE;
@@ -1442,8 +1448,8 @@ static int register_bound_param(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt,
    bind an input parameter to the value of a PHP variable.  $paramno is the 1-based position of the placeholder in the SQL statement (but can be the parameter name for drivers that support named placeholders).  It should be called prior to execute(). */
 static PHP_METHOD(PDOStatement, bindValue)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
        struct pdo_bound_param_data param = {0};
+       PHP_STMT_GET_OBJ;
 
        param.paramno = -1;
        param.param_type = PDO_PARAM_STR;
@@ -1472,7 +1478,7 @@ static PHP_METHOD(PDOStatement, bindValue)
    bind a parameter to a PHP variable.  $paramno is the 1-based position of the placeholder in the SQL statement (but can be the parameter name for drivers that support named placeholders).  This isn't supported by all drivers.  It should be called prior to execute(). */
 static PHP_METHOD(PDOStatement, bindParam)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
        RETURN_BOOL(register_bound_param(INTERNAL_FUNCTION_PARAM_PASSTHRU, stmt, TRUE));
 }
 /* }}} */
@@ -1481,7 +1487,7 @@ static PHP_METHOD(PDOStatement, bindParam)
    bind a column to a PHP variable.  On each row fetch $param will contain the value of the corresponding column.  $column is the 1-based offset of the column, or the column name.  For portability, don't call this before execute(). */
 static PHP_METHOD(PDOStatement, bindColumn)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
        RETURN_BOOL(register_bound_param(INTERNAL_FUNCTION_PARAM_PASSTHRU, stmt, FALSE));
 }
 /* }}} */
@@ -1490,7 +1496,7 @@ static PHP_METHOD(PDOStatement, bindColumn)
    Returns the number of rows in a result set, or the number of rows affected by the last execute().  It is not always meaningful. */
 static PHP_METHOD(PDOStatement, rowCount)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
 
        RETURN_LONG(stmt->row_count);
 }
@@ -1500,7 +1506,7 @@ static PHP_METHOD(PDOStatement, rowCount)
    Fetch the error code associated with the last operation on the statement handle */
 static PHP_METHOD(PDOStatement, errorCode)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
 
        if (ZEND_NUM_ARGS()) {
                RETURN_FALSE;
@@ -1514,7 +1520,7 @@ static PHP_METHOD(PDOStatement, errorCode)
    Fetch extended error information associated with the last operation on the statement handle */
 static PHP_METHOD(PDOStatement, errorInfo)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
 
        if (ZEND_NUM_ARGS()) {
                RETURN_FALSE;
@@ -1533,9 +1539,9 @@ static PHP_METHOD(PDOStatement, errorInfo)
    Set an attribute */
 static PHP_METHOD(PDOStatement, setAttribute)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
        long attr;
        zval *value = NULL;
+       PHP_STMT_GET_OBJ;
 
        if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "lz!", &attr, &value)) {
                RETURN_FALSE;
@@ -1564,8 +1570,8 @@ fail:
    Get an attribute */
 static PHP_METHOD(PDOStatement, getAttribute)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
        long attr;
+       PHP_STMT_GET_OBJ;
 
        if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &attr)) {
                RETURN_FALSE;
@@ -1597,7 +1603,7 @@ static PHP_METHOD(PDOStatement, getAttribute)
    Returns the number of columns in the result set */
 static PHP_METHOD(PDOStatement, columnCount)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
        if (ZEND_NUM_ARGS()) {
                RETURN_FALSE;
        }
@@ -1609,9 +1615,9 @@ static PHP_METHOD(PDOStatement, columnCount)
    Returns meta data for a numbered column */
 static PHP_METHOD(PDOStatement, getColumnMeta)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
        long colno;
        struct pdo_column_data *col;
+       PHP_STMT_GET_OBJ;
 
        if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &colno)) {
                RETURN_FALSE;
@@ -1775,7 +1781,7 @@ fail_out:
    
 static PHP_METHOD(PDOStatement, setFetchMode)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
 
        RETVAL_BOOL(
                pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAM_PASSTHRU,
@@ -1813,7 +1819,7 @@ static int pdo_stmt_do_next_rowset(pdo_stmt_t *stmt TSRMLS_DC)
 
 static PHP_METHOD(PDOStatement, nextRowset)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
 
        if (!stmt->methods->next_rowset) {
                pdo_raise_impl_error(stmt->dbh, stmt, "IM001", "driver does not support multiple rowsets" TSRMLS_CC);
@@ -1837,7 +1843,7 @@ static PHP_METHOD(PDOStatement, nextRowset)
    Closes the cursor, leaving the statement ready for re-execution. */
 static PHP_METHOD(PDOStatement, closeCursor)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
+       PHP_STMT_GET_OBJ;
 
        if (!stmt->methods->cursor_closer) {
                /* emulate it by fetching and discarding rows */
@@ -1871,10 +1877,10 @@ static PHP_METHOD(PDOStatement, closeCursor)
    A utility for internals hackers to debug parameter internals */
 static PHP_METHOD(PDOStatement, debugDumpParams)
 {
-       pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(getThis() TSRMLS_CC);
        php_stream *out = php_stream_open_wrapper("php://output", "w", 0, NULL);
        HashPosition pos;
        struct pdo_bound_param_data *param;
+       PHP_STMT_GET_OBJ;
 
        php_stream_printf(out TSRMLS_CC, "SQL: [%d] %.*s\n",
                stmt->query_stringlen,