MFB51: Fixed bug #35303 (PDO prepare() crashes with invalid parameters).

diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c
index 818c49dc27049cbadec08eefb4b4d56173b50ba1..6ad3b2596769b3641e2792099af8db793c841d2d 100755 (executable)
--- a/ext/pdo/pdo_dbh.c
+++ b/ext/pdo/pdo_dbh.c
@@ -508,7 +508,7 @@ static PHP_METHOD(PDO, prepare)
        PDO_CONSTRUCT_CHECK;
 
        if (ZEND_NUM_ARGS() > 1 && SUCCESS == zend_hash_index_find(Z_ARRVAL_P(options), PDO_ATTR_STATEMENT_CLASS, (void**)&opt)) {
-               if (zend_hash_index_find(Z_ARRVAL_PP(opt), 0, (void**)&item) == FAILURE
+               if (Z_TYPE_PP(opt) != IS_ARRAY || zend_hash_index_find(Z_ARRVAL_PP(opt), 0, (void**)&item) == FAILURE
                        || !PDO_ZVAL_PP_IS_TEXT(item)
                        || zend_u_lookup_class(Z_TYPE_PP(item), Z_UNIVAL_PP(item), Z_UNILEN_PP(item), &pce TSRMLS_CC) == FAILURE
                ) {