[php-src] PR #23736: Fix GH-23728: crash when a callback destroys the statement being executed
| From: | iliaal | Date: | Thu, 17 Sep 2026 18:54:50 +0000 |
| Subject: | [php-src] PR #23736: Fix GH-23728: crash when a callback destroys the statement being executed | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38540@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23736
Author: iliaal
SQLite3Stmt::close() and SQLite3Result::finalize() reach sqlite3_finalize() through the database
free list, and SQLite3Stmt::reset(), SQLite3Result::reset() and a sibling result's destructor
reach sqlite3_reset(). From a userland function, aggregate or collation callback, either destroys
the statement sqlite3_step() is executing. Tracking per statement whether it is being stepped,
throwing from the four methods and skipping the reset in the destructor, leaves the statement usable
once the query finishes. The per-database in_callback counter GH-23650 added for SQLite3::close() is
too coarse here, since finalizing an unrelated statement while another one steps is safe and keeps
working, and sqlite3_stmt_busy() would reject a close after a partial fetch outside any callback.
Fixes php/php-src#23728