MFB: Fixed bug #42978 (mismatch between number of bound params and values

causes a crash in pdo_pgsql)

diff --git a/NEWS b/NEWS
index a80c83de934ad1bdca4e789b1b682cce1bde3627..c510ddfc9692d1ab4f5efd5fa720a4fcc2503b94 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,8 @@ PHP                                                                        NEWS
   truncation). (Ilia)
 - Fixed bug #43175 (__destruct() throwing an exception with __call() causes
   segfault). (Dmitry)
+- Fixed bug #42978 (mismatch between number of bound params and values causes
+  a crash in pdo_pgsql). (Ilia)
 - Fixed bug #42937 (__call() method not invoked when methods are called on
   parent from child class). (Dmitry)
 - Fixed bug #42736 (xmlrpc_server_call_method() crashes). (Tony)

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 2cc242875504b4db4493ca4414fd6376e20f77fa..b1860ee2437069a27d999bc121f323dca104037a 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -168,6 +168,11 @@ static int dispatch_param_event(pdo_stmt_t *stmt, enum pdo_param_event event_typ
 
 iterate:
        if (ht) {
+               if (zend_hash_num_elements(stmt->bound_param_map) != zend_hash_num_elements(ht)) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of bound paramters %d does not match number of bound values %d", zend_hash_num_elements(stmt->bound_param_map), zend_hash_num_elements(ht));
+                       return 0;       
+               }
+
                zend_hash_internal_pointer_reset(ht);
                while (SUCCESS == zend_hash_get_current_data(ht, (void**)&param)) {
                        if (!stmt->methods->param_hook(stmt, param, event_type TSRMLS_CC)) {