MFH: fix #40727 (segfault in PDO when failed to bind parameters)

diff --git a/NEWS b/NEWS
index 91a815de67bf60d7a54043ba7b2529ab66e0e780..d7bc5cc0c49de56671564c4037a51bbb587cbde2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,7 @@ PHP                                                                        NEWS
 - Added --ri switch to CLI which allows to check extension information. (Marcus)
 - Added tidyNode::getParent() method (John, Nuno)
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
+- Fixed bug #40727 (segfault in PDO when failed to bind parameters). (Tony)
 - Fixed bug #40709 (array_reduce() behaves strange with one item stored arrays).
   (Ilia)
 - Fixed bug #40703 (Resolved a possible namespace conflict between libxmlrpc

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 4679b39e8c9e3ca18a35e278029c05f3bbd8e1b8..658d99ee62e0a7ac65ba2c2006e4201d9be59856 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -251,7 +251,10 @@ static void param_dtor(void *data) /* {{{ */
                efree(param->name);
        }
 
-       zval_ptr_dtor(&(param->parameter));
+       if (param->parameter) {
+               zval_ptr_dtor(&(param->parameter));
+               param->parameter = NULL;
+       }
        if (param->driver_params) {
                zval_ptr_dtor(&(param->driver_params));
        }
@@ -1557,7 +1560,10 @@ static int register_bound_param(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt,
 
        ZVAL_ADDREF(param.parameter);
        if (!really_register_bound_param(&param, stmt, is_param TSRMLS_CC)) {
-               zval_ptr_dtor(&(param.parameter));
+               if (param.parameter) {
+                       zval_ptr_dtor(&(param.parameter));
+                       param.parameter = NULL;
+               }
                return 0;
        }
        return 1;
@@ -1590,7 +1596,10 @@ static PHP_METHOD(PDOStatement, bindValue)
        
        ZVAL_ADDREF(param.parameter);
        if (!really_register_bound_param(&param, stmt, TRUE TSRMLS_CC)) {
-               zval_ptr_dtor(&(param.parameter));
+               if (param.parameter) {
+                       zval_ptr_dtor(&(param.parameter));
+                       param.parameter = NULL;
+               }
                RETURN_FALSE;
        }
        RETURN_TRUE;