Fixed bug #37445 (Fixed crash in pdo_mysql resulting from premature object

destruction).

diff --git a/NEWS b/NEWS
index 88c9f6e8b64aad370e9fc23be6488780282a8aca..eb947a4883a87110478806fb13668f9225305bb1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -54,6 +54,8 @@ PHP                                                                        NEWS
   SQLT_AFC, AVC). (Tony)
 - Fixed bug #37564 (AES privacy encryption not possible due to net-snmp 5.2
   compatibility issue). (Jani, patch by scott dot moynes+php at gmail dot com)
+- Fixed bug #37445 (Fixed crash in pdo_mysql resulting from premature object
+  destruction). (Ilia)
 
 24 Jul 2006, PHP 5.2.0RC1
 - Updated bundled MySQL client library to version 5.0.22 in the Windows

diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c
index c82bb47c335612331d5835aac5cceea1fc971a97..e98188fb14b6360f8afaebe02d3925cb22aaece3 100755 (executable)
--- a/ext/pdo/pdo_dbh.c
+++ b/ext/pdo/pdo_dbh.c
@@ -570,6 +570,7 @@ static PHP_METHOD(PDO, prepare)
        stmt->dbh = dbh;
        /* give it a reference to me */
        zend_objects_store_add_ref(getThis() TSRMLS_CC);
+       php_pdo_dbh_addref(dbh TSRMLS_CC);
        stmt->database_object_handle = *getThis();
        /* we haven't created a lazy object yet */
        ZVAL_NULL(&stmt->lazy_object_ref);
@@ -1016,6 +1017,7 @@ static PHP_METHOD(PDO, query)
        stmt->dbh = dbh;
        /* give it a reference to me */
        zend_objects_store_add_ref(getThis() TSRMLS_CC);
+       php_pdo_dbh_addref(dbh TSRMLS_CC);
        stmt->database_object_handle = *getThis();
        /* we haven't created a lazy object yet */
        ZVAL_NULL(&stmt->lazy_object_ref);

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 057e339f51a2e0cbb860c4a2aa4e8311dd1d156e..9996da7ef67332bd459ce5efe66a5613b0a0416b 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2258,6 +2258,7 @@ static void free_statement(pdo_stmt_t *stmt TSRMLS_DC)
        do_fetch_opt_finish(stmt, 1 TSRMLS_CC);
 
        zend_objects_store_del_ref(&stmt->database_object_handle TSRMLS_CC);
+       php_pdo_dbh_delref(stmt->dbh TSRMLS_CC);
        efree(stmt);
 }
 

diff --git a/ext/pdo_mysql/tests/bug_37445.phpt b/ext/pdo_mysql/tests/bug_37445.phpt
new file mode 100644 (file)
index 0000000..c4d7600
--- /dev/null
+++ b/ext/pdo_mysql/tests/bug_37445.phpt
@@ -0,0 +1,21 @@
+--TEST--
+PDO MySQL Bug #37445 (Premature stmt object destruction) 
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo') || !extension_loaded('pdo_mysql')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+
+$db->setAttribute(PDO :: ATTR_EMULATE_PREPARES, true);
+$stmt = $db->prepare("SELECT 1");
+$stmt->bindParam(':a', 'b');
+
+--EXPECTF--
+Fatal error: Cannot pass parameter 2 by reference in %s/bug_37445.php on line %d
\ No newline at end of file

diff --git a/ext/pdo_mysql/tests/common.phpt b/ext/pdo_mysql/tests/common.phpt
index 1d11e0f7e7759b70facf28ae013f482f10bc8f79..8179454cf76d1370812a2f097717c581231a117b 100644 (file)
--- a/ext/pdo_mysql/tests/common.phpt
+++ b/ext/pdo_mysql/tests/common.phpt
@@ -22,7 +22,7 @@ if (false !== getenv('PDO_MYSQL_TEST_DSN')) {
 } else {
        $config['ENV']['PDOTEST_DSN'] = 'mysql:host=localhost;dbname=test';
        $config['ENV']['PDOTEST_USER'] = 'root';
-       $config['ENV']['PDOTEST_PASS'] = 'asukasmysql';
+       $config['ENV']['PDOTEST_PASS'] = '';
 }
 
 return $config;