com php-src: Fixed bug #72571 (SQLite3::bindValue, SQLite3::bindParam crash): NEWS ext/sqlite3/sqlite3.c ext/sqlite3/tests/bug72571.phpt

Commit: a19655cfe39e4207da211610e3fc6550a6af07a0 Author: Xinchen Hui <laruence@gmail.com> Mon, 11 Jul 2016 11:51:19 +0800 Parents: 4d677ae0e2465188f59ec9226ee16011692286c8 Branches: PHP-7.0 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=a19655cfe39e4207da211610e3fc6550a6af07a0 Log: Fixed bug #72571 (SQLite3::bindValue, SQLite3::bindParam crash) Bugs: https://bugs.php.net/72571 Changed paths: M NEWS M ext/sqlite3/sqlite3.c A ext/sqlite3/tests/bug72571.phpt Diff: diff --git a/NEWS b/NEWS index 9af6d5a..64cffd9 100644 --- a/NEWS +++ b/NEWS @@ -19,6 +19,9 @@ PHP NEWS - SPL: . Fixed bug #55701 (GlobIterator throws LogicException). (Valentin VĂLCIU) +- SQLite3: + . Fixed bug #72571 (SQLite3::bindValue, SQLite3::bindParam crash). (Laruence) + - Standard: . Fixed bug #72152 (base64_decode $strict fails to detect null byte). (Lauri Kenttä) diff --git a/ext/sqlite3/sqlite3.c b/ext/sqlite3/sqlite3.c index 9436c15..0e0ef09 100644 --- a/ext/sqlite3/sqlite3.c +++ b/ext/sqlite3/sqlite3.c @@ -1394,7 +1394,9 @@ static int register_bound_parameter_to_sqlite(struct php_sqlite3_bound_param *pa } if (param->param_number < 1) { - zend_string_release(param->name); + if (param->name) { + zend_string_release(param->name); + } return 0; } diff --git a/ext/sqlite3/tests/bug72571.phpt b/ext/sqlite3/tests/bug72571.phpt new file mode 100644 index 0000000..3ffde29 --- /dev/null +++ b/ext/sqlite3/tests/bug72571.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #72571 (SQLite3::bindValue, SQLite3::bindParam crash) +--SKIPIF-- +<?php +if (!extension_loaded('sqlite3')) die('skip'); ?> +--FILE-- +<?php +$db = new SQLite3(':memory:'); + +$stmt = $db->prepare("select 1 = ?"); + +// bindParam crash +$i = 0; +$stmt->bindParam(0, $i); + +var_dump($stmt->execute()); +$db->close(); +?> +--EXPECTF-- +object(SQLite3Result)#%d (0) { +}