- Fixed PDORow and PDOStatement crashes when instantiating throught Reflection

diff --git a/Zend/zend_objects.c b/Zend/zend_objects.c
index df952bd9d45fde93bc020c256996ec639a11b797..d6699a8589ac3ee6f5898df9a2a258ab246aef09 100644 (file)
--- a/Zend/zend_objects.c
+++ b/Zend/zend_objects.c
@@ -51,7 +51,7 @@ ZEND_API void zend_object_std_dtor(zend_object *object TSRMLS_DC) /* {{{ */
 
 ZEND_API void zend_objects_destroy_object(zend_object *object, zend_object_handle handle TSRMLS_DC) /* {{{ */
 {
-       zend_function *destructor = object->ce->destructor;
+       zend_function *destructor = object ? object->ce->destructor : NULL;
 
        if (destructor) {
                zval *obj;

diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c
index 283980c8b50cec5647ea12b057fb2b3cde826802..d3ccdcdc749a91be156b74f4f8d04ced3c99c7df 100755 (executable)
--- a/ext/pdo/pdo_dbh.c
+++ b/ext/pdo/pdo_dbh.c
@@ -110,7 +110,7 @@ void pdo_handle_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt TSRMLS_DC) /* {{{ */
        char *message = NULL;
        zval *info = NULL;
 
-       if (dbh->error_mode == PDO_ERRMODE_SILENT) {
+       if (dbh == NULL || dbh->error_mode == PDO_ERRMODE_SILENT) {
                return;
        }
        

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 2c0f7a4d7ec0d685625ce6e449be068837c25be2..07826fb3eb8fbba8f5c03c9f65fb660100541a4d 100755 (executable)
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2673,26 +2673,28 @@ static zval *row_prop_or_dim_read(zval *object, zval *member, int type TSRMLS_DC
 
        MAKE_STD_ZVAL(return_value);
        RETVAL_NULL();
-               
-       if (Z_TYPE_P(member) == IS_LONG) {
-               if (Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count) {
-                       fetch_value(stmt, return_value, Z_LVAL_P(member), NULL TSRMLS_CC);
-               }
-       } else {
-               convert_to_string(member);
-               /* TODO: replace this with a hash of available column names to column
-                * numbers */
-               for (colno = 0; colno < stmt->column_count; colno++) {
-                       if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
-                               fetch_value(stmt, return_value, colno, NULL TSRMLS_CC);
-                               Z_SET_REFCOUNT_P(return_value, 0);
-                               Z_UNSET_ISREF_P(return_value);
-                               return return_value;
+
+       if (stmt) {
+               if (Z_TYPE_P(member) == IS_LONG) {
+                       if (Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count) {
+                               fetch_value(stmt, return_value, Z_LVAL_P(member), NULL TSRMLS_CC);
+                       }
+               } else {
+                       convert_to_string(member);
+                       /* TODO: replace this with a hash of available column names to column
+                        * numbers */
+                       for (colno = 0; colno < stmt->column_count; colno++) {
+                               if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
+                                       fetch_value(stmt, return_value, colno, NULL TSRMLS_CC);
+                                       Z_SET_REFCOUNT_P(return_value, 0);
+                                       Z_UNSET_ISREF_P(return_value);
+                                       return return_value;
+                               }
+                       }
+                       if (strcmp(Z_STRVAL_P(member), "queryString") == 0) {
+                               zval_ptr_dtor(&return_value);
+                               return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
                        }
-               }
-               if (strcmp(Z_STRVAL_P(member), "queryString") == 0) {
-                       zval_ptr_dtor(&return_value);
-                       return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
                }
        }
 
@@ -2712,16 +2714,18 @@ static int row_prop_or_dim_exists(zval *object, zval *member, int check_empty TS
        pdo_stmt_t * stmt = (pdo_stmt_t *) zend_object_store_get_object(object TSRMLS_CC);
        int colno = -1;
 
-       if (Z_TYPE_P(member) == IS_LONG) {
-               return Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count;
-       } else {
-               convert_to_string(member);
+       if (stmt) {
+               if (Z_TYPE_P(member) == IS_LONG) {
+                       return Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count;
+               } else {
+                       convert_to_string(member);
 
-               /* TODO: replace this with a hash of available column names to column
-                * numbers */
-               for (colno = 0; colno < stmt->column_count; colno++) {
-                       if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
-                               return 1;
+                       /* TODO: replace this with a hash of available column names to column
+                        * numbers */
+                       for (colno = 0; colno < stmt->column_count; colno++) {
+                               if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
+                                       return 1;
+                               }
                        }
                }
        }
@@ -2739,6 +2743,10 @@ static HashTable *row_get_properties(zval *object TSRMLS_DC)
        pdo_stmt_t * stmt = (pdo_stmt_t *) zend_object_store_get_object(object TSRMLS_CC);
        int i;
 
+       if (stmt == NULL) {
+               return NULL;
+       }
+       
        for (i = 0; i < stmt->column_count; i++) {
                zval *val;
                MAKE_STD_ZVAL(val);

diff --git a/ext/pdo/tests/pdo_036.phpt b/ext/pdo/tests/pdo_036.phpt
new file mode 100644 (file)
index 0000000..6bd38cb
--- /dev/null
+++ b/ext/pdo/tests/pdo_036.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Testing PDORow and PDOStatement instances with Reflection
+--FILE--
+<?php
+
+$instance = new reflectionclass('pdorow');
+$x = $instance->newInstance();
+var_dump($x);
+
+$instance = new reflectionclass('pdostatement');
+$x = $instance->newInstance();
+var_dump($x);
+
+?>
+--EXPECTF--
+object(PDORow)#%d (0) {
+}
+object(PDOStatement)#%d (1) {
+  [%u|b%"queryString"]=>
+  NULL
+}