[php-src] PR #23762: Fix GH-23756: crash when a collation callback closes the statement cursor
| From: | lazerg | Date: | Fri, 18 Sep 2026 21:02:33 +0000 |
| Subject: | [php-src] PR #23762: Fix GH-23756: crash when a collation callback closes the statement cursor | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38571@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23762
Author: lazerg
PDOStatement::closeCursor() calls sqlite3_reset() on the underlying sqlite3_stmt. When a collation
callback calls it, the reset lands on the statement sqlite3_step() is still running, SQLite tears
down the VDBE under itself, and the process segfaults. Calling execute() again from the same
callback crashes the same way, through the reset in the parameter hook and the nested step.
The driver statement now records that it is being stepped, and both paths throw an Error instead of
reaching SQLite. The running query still finishes, so the statement is usable afterwards. The flag
is restored on a bailout too, which keeps closeCursor() working in a shutdown function after a
callback called exit().
Fixes #23756