Bug #61183 [Com]: Firebird PDO memory corruption

Edit report at https://bugs.php.net/bug.php?id=61183&edit=1 ID: 61183 Comment by: mariuz@php.net Reported by: noxwizard at gmail dot com Summary: Firebird PDO memory corruption Status: Assigned Type: Bug Package: PDO Firebird Operating System: Windows Server 2008 x86 PHP Version: 5.5 Assigned To: mariuz Block user comment: N Private report: N New Comment: db created https://gist.github.com/mariuz/108810265b9c67fc747d#file-test-db-for-phpbug-61183-sql test https://gist.github.com/mariuz/b00d148812e3a1657ef1 ran without issues ... Statement run: 4999 Previous Comments: ------------------------------------------------------------------------ [2015-07-16 13:41:28] mariuz@php.net Started to test the patch patch -p1 < ~/Downloads/Blob_Bind_Fix.patch.txt patching file ext/pdo_firebird/firebird_statement.c Hunk #1 succeeded at 422 (offset -2 lines). ------------------------------------------------------------------------ [2013-02-13 04:25:05] james at kenjim dot com Related To: Bug #63356 ------------------------------------------------------------------------ [2012-10-16 03:08:42] paul dot ishenin at gmail dot com I have a crash (0xc0000005 exception) when I execute a statement which inserts or updates blob and values are bind using bindValue(). But if I use bindParam() instead there is no crash. For example: $q = Yii::app()->db->createCommand('INSERT INTO TEST (BL) VALUES (:bl)'); // this will crash $q->bindValue(':bl', bl, PDO::PARAM_LOB); $q->bindParam(':bl', bl, PDO::PARAM_LOB); // this will not crash $q->execute(); ------------------------------------------------------------------------ [2012-10-05 08:25:08] james at kenjim dot com After further testing I've found that NULL zval's may be passed into firebird_bind_blob so convert_to_string_ex needs to be called or a check for NULL param needs to be done before calling Z_STRLEN_P. ------------------------------------------------------------------------ [2012-10-04 08:30:24] james at kenjim dot com This problem appears to comes from the handling of blobs. In the function firebird_bind_blob in firebird_statement.c we pass param in and are destroying it with zval_dtor. I think we should not be destroying it because it was provided by firebird_stmt_param_hook and no other path destroys this variable. Commenting out the zval_dtor(param) line fixes the crashing. I also don't think we need to call SEPARATE_ZVAL(&param) or convert_to_string_ex(&param) as param appears to always be a string regardless of what we bind. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=61183 -- Edit this bug report at https://bugs.php.net/bug.php?id=61183&edit=1