From: Felipe Pena <felipe@php.net>
Date: Mon, 3 Nov 2008 23:43:51 +0000 (+0000)
Subject: - Improved fix
X-Git-Tag: BEFORE_HEAD_NS_CHANGE~97
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0d97fcdaed424031326048ddd8dd76563adf0f77;p=php

- Improved fix
---

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index bfdd026cda..e8dd0f70e9 100755
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2623,11 +2623,8 @@ static zval *row_prop_or_dim_read(zval *object, zval *member, int type TSRMLS_DC
 	pdo_stmt_t * stmt = (pdo_stmt_t *) zend_object_store_get_object(object TSRMLS_CC);
 	int colno = -1;
 
-	if ((Z_TYPE_P(member) == IS_STRING || Z_TYPE_P(member) == IS_UNICODE) &&
-		memcmp(Z_UNIVAL_P(member).v, "queryString", sizeof("queryString")-1)) {
-		return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
-	}
 	MAKE_STD_ZVAL(return_value);
+	RETVAL_NULL();
 		
 	if (Z_TYPE_P(member) == IS_LONG) {
 		if (Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count) {
@@ -2640,9 +2637,14 @@ static zval *row_prop_or_dim_read(zval *object, zval *member, int type TSRMLS_DC
 		for (colno = 0; colno < stmt->column_count; colno++) {
 			if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
 				fetch_value(stmt, return_value, colno, NULL TSRMLS_CC);
-				break;
+				Z_SET_REFCOUNT_P(return_value, 0);
+				Z_UNSET_ISREF_P(return_value);
+				return return_value;
 			}
 		}
+		if (strcmp(Z_STRVAL_P(member), "queryString") == 0) {
+			return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
+		}
 	}
 
 	Z_SET_REFCOUNT_P(return_value, 0);
diff --git a/ext/pdo_sqlite/tests/bug44327_3.phpt b/ext/pdo_sqlite/tests/bug44327_3.phpt
new file mode 100644
index 0000000000..4d704c3d65
--- /dev/null
+++ b/ext/pdo_sqlite/tests/bug44327_3.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #44327.3 (PDORow::queryString property & numeric offsets / Crash)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_sqlite')) print 'skip not loaded';
+?>
+--FILE--
+<?php
+
+$db = new pdo('sqlite:memory');
+
+$x = $db->query('select 1 as queryStringxx');
+$y = $x->fetch(PDO::FETCH_LAZY);
+var_dump($y, $y->queryString, $y->queryStringzz, $y->queryStringxx);
+
+print "---\n";
+
+var_dump($y[5], $y->{3});
+
+?>
+--EXPECTF--
+object(PDORow)#%d (2) {
+  ["queryString"]=>
+  string(25) "select 1 as queryStringxx"
+  ["queryStringxx"]=>
+  string(1) "1"
+}
+string(25) "select 1 as queryStringxx"
+NULL
+string(1) "1"
+---
+NULL
+NULL