[php-src] PR #23751: Fix GH-23741: pdo_dblib use-after-free of statement error state

From: Date: Fri, 18 Sep 2026 11:56:20 +0000
Subject: [php-src] PR #23751: Fix GH-23741: pdo_dblib use-after-free of statement error state
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38558@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23751 Author: iliaal pdo_dblib_stmt_execute() publishes the statement's error struct to the DBPROCESS with dbsetuserdata(), and FreeTDS keeps handing that pointer to the message handlers for the rest of the connection's life, long after the statement is freed. A statement cannot take the pointer back from its own destructor, since a GC cycle can free the connection handle first, so every function that hands the link to libdblib now installs the error struct it owns. A failing beginTransaction(), commit(), rollBack() or lastInsertId() now reports its error; the stale SQLSTATE write previously left dbh->error_code untouched, so PDO stayed silent. rollBack() returns false in the reporter's script for an unrelated reason, SQL Server having already rolled the batch back itself, so the test does not assert its return value. Fixes #23741

« previous php.git-pulls (#38558) next »