[php-src] PR #23751: Fix GH-23741: pdo_dblib use-after-free of statement error state
| From: | iliaal | Date: | Fri, 18 Sep 2026 11:56:20 +0000 |
| Subject: | [php-src] PR #23751: Fix GH-23741: pdo_dblib use-after-free of statement error state | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38558@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23751
Author: iliaal
pdo_dblib_stmt_execute() publishes the statement's error struct to the DBPROCESS
with dbsetuserdata(), and FreeTDS keeps handing that pointer to the message handlers
for the rest of the connection's life, long after the statement is freed. A statement cannot
take the pointer back from its own destructor, since a GC cycle can free the connection handle
first, so every function that hands the link to libdblib now installs the error struct it owns.
A failing beginTransaction(), commit(), rollBack() or lastInsertId() now reports its error; the
stale SQLSTATE write previously left dbh->error_code untouched, so PDO stayed silent. rollBack()
returns false in the reporter's script for an unrelated reason, SQL Server having already
rolled the batch back itself, so the test does not assert its return value.
Fixes #23741