Fix #32009 crash when mssql_bind() is called more than once

diff --git a/NEWS b/NEWS
index 78f6ea1cb41fce4877cb28cb3aae99272b0dd153..01c796782f0e1bc36807f60b3744f140bf5666f8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -27,3 +27,4 @@ PHP                                                                        NEWS
   defined using reflection API. (Johannes)
 - Fixed bug #34286 (__toString() behavior is inconsistent). (Marcus)
 - Fixed bug #33153 (crash in mssql_next result). (Frank)
+- Fixed bug #32009 (crash when mssql_bind() is called more than once). (Frank)

diff --git a/ext/mssql/php_mssql.c b/ext/mssql/php_mssql.c
index ea14451dea53e4b4da913df97fd7b207be0bbdee..25d49582f58fcb1af23e79a3953fd6b7f477ca06 100644 (file)
--- a/ext/mssql/php_mssql.c
+++ b/ext/mssql/php_mssql.c
@@ -2114,17 +2114,22 @@ PHP_FUNCTION(mssql_bind)
                zend_hash_init(statement->binds, 13, NULL, _mssql_bind_hash_dtor, 0);
        }
 
-       memset((void*)&bind,0,sizeof(mssql_bind));
-       zend_hash_add(statement->binds,Z_STRVAL_PP(param_name),Z_STRLEN_PP(param_name),&bind,sizeof(mssql_bind),(void **)&bindp);
-       if( NULL == bindp ) RETURN_FALSE;
-       bindp->zval=*var;
-       zval_add_ref(var);
-
-       /* no call to dbrpcparam if RETVAL */
-       if ( strcmp("RETVAL",Z_STRVAL_PP(param_name))!=0 ) {                                            
-               if (dbrpcparam(mssql_ptr->link, Z_STRVAL_PP(param_name), (BYTE)status, type, maxlen, datalen, (LPBYTE)value)==FAIL) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set parameter");
-                       RETURN_FALSE;
+       if (zend_hash_exists(statement->binds, Z_STRVAL_PP(param_name), Z_STRLEN_PP(param_name))) {
+               RETURN_FALSE;
+       }
+       else {
+               memset((void*)&bind,0,sizeof(mssql_bind));
+               zend_hash_add(statement->binds, Z_STRVAL_PP(param_name), Z_STRLEN_PP(param_name), &bind, sizeof(mssql_bind), (void **)&bindp);
+               if( NULL == bindp ) RETURN_FALSE;
+               bindp->zval=*var;
+               zval_add_ref(var);
+       
+               /* no call to dbrpcparam if RETVAL */
+               if ( strcmp("RETVAL",Z_STRVAL_PP(param_name))!=0 ) {                                            
+                       if (dbrpcparam(mssql_ptr->link, Z_STRVAL_PP(param_name), (BYTE)status, type, maxlen, datalen, (LPBYTE)value)==FAIL) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set parameter");
+                               RETURN_FALSE;
+                       }
                }
        }