From: Antony Dovgal <tony2001@php.net>
Date: Wed, 7 Mar 2007 09:03:07 +0000 (+0000)
Subject: MFH: fix #40727 (segfault in PDO when failed to bind parameters)
X-Git-Tag: php-5.2.2RC1~199
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c73225ab6190a11807f6f44c4fbfaff27a89e012;p=php

MFH: fix #40727 (segfault in PDO when failed to bind parameters)
---

diff --git a/NEWS b/NEWS
index 91a815de67..d7bc5cc0c4 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,7 @@ PHP                                                                        NEWS
 - Added --ri switch to CLI which allows to check extension information. (Marcus)
 - Added tidyNode::getParent() method (John, Nuno)
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
+- Fixed bug #40727 (segfault in PDO when failed to bind parameters). (Tony)
 - Fixed bug #40709 (array_reduce() behaves strange with one item stored arrays).
   (Ilia)
 - Fixed bug #40703 (Resolved a possible namespace conflict between libxmlrpc
diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 4679b39e8c..658d99ee62 100755
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -251,7 +251,10 @@ static void param_dtor(void *data) /* {{{ */
 		efree(param->name);
 	}
 
-	zval_ptr_dtor(&(param->parameter));
+	if (param->parameter) {
+		zval_ptr_dtor(&(param->parameter));
+		param->parameter = NULL;
+	}
 	if (param->driver_params) {
 		zval_ptr_dtor(&(param->driver_params));
 	}
@@ -1557,7 +1560,10 @@ static int register_bound_param(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt,
 
 	ZVAL_ADDREF(param.parameter);
 	if (!really_register_bound_param(&param, stmt, is_param TSRMLS_CC)) {
-		zval_ptr_dtor(&(param.parameter));
+		if (param.parameter) {
+			zval_ptr_dtor(&(param.parameter));
+			param.parameter = NULL;
+		}
 		return 0;
 	}
 	return 1;
@@ -1590,7 +1596,10 @@ static PHP_METHOD(PDOStatement, bindValue)
 	
 	ZVAL_ADDREF(param.parameter);
 	if (!really_register_bound_param(&param, stmt, TRUE TSRMLS_CC)) {
-		zval_ptr_dtor(&(param.parameter));
+		if (param.parameter) {
+			zval_ptr_dtor(&(param.parameter));
+			param.parameter = NULL;
+		}
 		RETURN_FALSE;
 	}
 	RETURN_TRUE;