From: Antony Dovgal <tony2001@php.net>
Date: Wed, 31 Jan 2007 10:36:20 +0000 (+0000)
Subject: fix segfault on re-binding and re-executing a statement
X-Git-Tag: RELEASE_1_0_0RC1~59
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=74e11c349cf4c3b82912185aae2d20332600e8c3;p=php

fix segfault on re-binding and re-executing a statement
improve the test
patch by Chris Jones
---

diff --git a/ext/oci8/oci8_statement.c b/ext/oci8/oci8_statement.c
index f0a6d5e3da..6621cc7292 100644
--- a/ext/oci8/oci8_statement.c
+++ b/ext/oci8/oci8_statement.c
@@ -1147,7 +1147,17 @@ sb4 php_oci_bind_out_callback(
 	
 	phpbind->out = 1; /* mark as OUT bind */
 
-	if ((Z_TYPE_P(val) == IS_OBJECT) || (Z_TYPE_P(val) == IS_RESOURCE)) {
+	if (Z_TYPE_P(val) == IS_RESOURCE) {
+		retval = OCI_CONTINUE;
+	} else if (Z_TYPE_P(val) == IS_OBJECT) {
+		if (!phpbind->descriptor) {
+			return OCI_ERROR;
+		}
+		*alenpp = &phpbind->dummy_len;
+		*bufpp = phpbind->descriptor;
+		*piecep = OCI_ONE_PIECE;
+		*rcodepp = &phpbind->retcode;
+		*indpp = &phpbind->indicator;
 		retval = OCI_CONTINUE;
 	} else { 
 		if (UG(unicode)) {
diff --git a/ext/oci8/php_oci8_int.h b/ext/oci8/php_oci8_int.h
index 2c28295e7a..6d10ab10aa 100644
--- a/ext/oci8/php_oci8_int.h
+++ b/ext/oci8/php_oci8_int.h
@@ -199,6 +199,7 @@ typedef struct { /* php_oci_bind {{{ */
 	sb2 indicator;			/* -1 means NULL */
 	ub2 retcode;			/*  */
 	zend_bool out;			/* OUT bind or not */
+	ub4 dummy_len;			/* a dummy var to store alenpp value in bind OUT callback */
 } php_oci_bind; /* }}} */
 
 typedef struct { /* php_oci_out_column {{{ */
diff --git a/ext/oci8/tests/oci_execute_segfault.phpt b/ext/oci8/tests/oci_execute_segfault.phpt
index 3859f4ffe0..9e4e23b202 100644
--- a/ext/oci8/tests/oci_execute_segfault.phpt
+++ b/ext/oci8/tests/oci_execute_segfault.phpt
@@ -1,30 +1,54 @@
 --TEST--
-oci_execute() segfault after repeated bind
+oci_execute() segfault after repeated bind of LOB descriptor
 --SKIPIF--
 <?php if (!extension_loaded('oci8')) die("skip no oci8 extension"); ?>
 --FILE--
 <?php
-	
+
 require dirname(__FILE__).'/connect.inc';
 require dirname(__FILE__).'/create_table.inc';
 
 $ora_sql = "INSERT INTO
-                       ".$table_name." (blob, clob)
+                       ".$schema.$table_name." (blob, clob)
                       VALUES (empty_blob(), empty_clob())
                       RETURNING
-                               blob
-                      INTO :v_blob ";
+                               clob
+                      INTO :v_clob ";
+
+$s = oci_parse($c, $ora_sql);
+$clob = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($s, ":v_clob", $clob, -1, OCI_B_CLOB);
+oci_execute($s, OCI_DEFAULT);
+var_dump($clob->save("some text data"));
+
+oci_bind_by_name($s, ":v_clob", $clob, -1, OCI_B_CLOB);
+oci_execute($s, OCI_DEFAULT);
+var_dump($clob->save("some more text data"));
 
-$s = oci_parse($c,$ora_sql);
-$blob = oci_new_descriptor($c,OCI_D_LOB);
-oci_bind_by_name($s,":v_blob", $blob,-1,OCI_B_BLOB);
-oci_execute($s);
+$query = 'SELECT clob, DBMS_LOB.GETLENGTH(clob) FROM '.$schema.$table_name.' ORDER BY 2';
 
-oci_bind_by_name($s,":v_blob", $blob,-1,OCI_B_BLOB);
-oci_execute($s);
+$s = oci_parse ($c, $query);
+oci_execute($s, OCI_DEFAULT);
+
+while ($arr = oci_fetch_assoc($s)) {
+    $result = $arr['CLOB']->load();
+    var_dump($result);
+}
+
+require dirname(__FILE__).'/drop_table.inc';
 
 echo "Done\n";
 
 ?>
 --EXPECT--
+bool(true)
+bool(true)
+string(14) "some text data"
+string(19) "some more text data"
+Done
+--UEXPECT--
+bool(true)
+bool(true)
+unicode(14) "some text data"
+unicode(19) "some more text data"
 Done