From c6ace95236d5b728b0886ad26a3b8c6dd1486780 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 31 Jul 2006 20:18:11 +0000
Subject: [PATCH] Fixed bug #37445 (Fixed crash in pdo_mysql resulting from
 premature object destruction).

---
 NEWS                               |  2 ++
 ext/pdo/pdo_dbh.c                  |  2 ++
 ext/pdo/pdo_stmt.c                 |  1 +
 ext/pdo_mysql/tests/bug_37445.phpt | 21 +++++++++++++++++++++
 ext/pdo_mysql/tests/common.phpt    |  2 +-
 5 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 ext/pdo_mysql/tests/bug_37445.phpt

diff --git a/NEWS b/NEWS
index 88c9f6e8b6..eb947a4883 100644
--- a/NEWS
+++ b/NEWS
@@ -54,6 +54,8 @@ PHP                                                                        NEWS
   SQLT_AFC, AVC). (Tony)
 - Fixed bug #37564 (AES privacy encryption not possible due to net-snmp 5.2
   compatibility issue). (Jani, patch by scott dot moynes+php at gmail dot com)
+- Fixed bug #37445 (Fixed crash in pdo_mysql resulting from premature object
+  destruction). (Ilia)
 
 24 Jul 2006, PHP 5.2.0RC1
 - Updated bundled MySQL client library to version 5.0.22 in the Windows
diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c
index c82bb47c33..e98188fb14 100755
--- a/ext/pdo/pdo_dbh.c
+++ b/ext/pdo/pdo_dbh.c
@@ -570,6 +570,7 @@ static PHP_METHOD(PDO, prepare)
 	stmt->dbh = dbh;
 	/* give it a reference to me */
 	zend_objects_store_add_ref(getThis() TSRMLS_CC);
+	php_pdo_dbh_addref(dbh TSRMLS_CC);
 	stmt->database_object_handle = *getThis();
 	/* we haven't created a lazy object yet */
 	ZVAL_NULL(&stmt->lazy_object_ref);
@@ -1016,6 +1017,7 @@ static PHP_METHOD(PDO, query)
 	stmt->dbh = dbh;
 	/* give it a reference to me */
 	zend_objects_store_add_ref(getThis() TSRMLS_CC);
+	php_pdo_dbh_addref(dbh TSRMLS_CC);
 	stmt->database_object_handle = *getThis();
 	/* we haven't created a lazy object yet */
 	ZVAL_NULL(&stmt->lazy_object_ref);
diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 057e339f51..9996da7ef6 100755
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2258,6 +2258,7 @@ static void free_statement(pdo_stmt_t *stmt TSRMLS_DC)
 	do_fetch_opt_finish(stmt, 1 TSRMLS_CC);
 
 	zend_objects_store_del_ref(&stmt->database_object_handle TSRMLS_CC);
+	php_pdo_dbh_delref(stmt->dbh TSRMLS_CC);
 	efree(stmt);
 }
 
diff --git a/ext/pdo_mysql/tests/bug_37445.phpt b/ext/pdo_mysql/tests/bug_37445.phpt
new file mode 100644
index 0000000000..c4d760083d
--- /dev/null
+++ b/ext/pdo_mysql/tests/bug_37445.phpt
@@ -0,0 +1,21 @@
+--TEST--
+PDO MySQL Bug #37445 (Premature stmt object destruction) 
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo') || !extension_loaded('pdo_mysql')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+
+$db->setAttribute(PDO :: ATTR_EMULATE_PREPARES, true);
+$stmt = $db->prepare("SELECT 1");
+$stmt->bindParam(':a', 'b');
+
+--EXPECTF--
+Fatal error: Cannot pass parameter 2 by reference in %s/bug_37445.php on line %d
\ No newline at end of file
diff --git a/ext/pdo_mysql/tests/common.phpt b/ext/pdo_mysql/tests/common.phpt
index 1d11e0f7e7..8179454cf7 100644
--- a/ext/pdo_mysql/tests/common.phpt
+++ b/ext/pdo_mysql/tests/common.phpt
@@ -22,7 +22,7 @@ if (false !== getenv('PDO_MYSQL_TEST_DSN')) {
 } else {
 	$config['ENV']['PDOTEST_DSN'] = 'mysql:host=localhost;dbname=test';
 	$config['ENV']['PDOTEST_USER'] = 'root';
-	$config['ENV']['PDOTEST_PASS'] = 'asukasmysql';
+	$config['ENV']['PDOTEST_PASS'] = '';
 }
 
 return $config;
-- 
2.40.0