Skip to content

Commit 2dde07a

Browse files
committed
Fix memory leak when destroying PDORow
This should call zend_object_std_dtor() to clean the property table etc. This also has a semantic influence because previously weak refs were not notified for example. This fixes the final issue in GH-18114 (the crash was master-only and fixed already). Closes GH-18114. Closes GH-18123.
1 parent 6af240d commit 2dde07a

File tree

3 files changed

+23
-0
lines changed

3 files changed

+23
-0
lines changed

NEWS

+3
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ PHP NEWS
3737
- Opcache:
3838
. Fixed bug GH-18112 (NULL access with preloading and INI option). (nielsdos)
3939

40+
- PDO:
41+
. Fix memory leak when destroying PDORow. (nielsdos)
42+
4043
- SPL:
4144
. Fixed bug GH-18018 (RC1 data returned from offsetGet causes UAF in
4245
ArrayObject). (nielsdos)

ext/pdo/pdo_stmt.c

+1
Original file line numberDiff line numberDiff line change
@@ -2506,6 +2506,7 @@ void pdo_row_free_storage(zend_object *std)
25062506
ZVAL_UNDEF(&row->stmt->lazy_object_ref);
25072507
OBJ_RELEASE(&row->stmt->std);
25082508
}
2509+
zend_object_std_dtor(std);
25092510
}
25102511

25112512
zend_object *pdo_row_new(zend_class_entry *ce)

ext/pdo_sqlite/tests/gh18114.phpt

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
--TEST--
2+
GH-18114 (pdo lazy object crash)
3+
--EXTENSIONS--
4+
pdo_sqlite
5+
--FILE--
6+
<?php
7+
$db = new PDO('sqlite::memory:');
8+
$x = $db->query('select 1 as queryString');
9+
$data = $x->fetch(PDO::FETCH_LAZY);
10+
foreach ($data as $entry) {
11+
var_dump($entry);
12+
}
13+
var_dump((array) $data);
14+
echo "Done\n";
15+
?>
16+
--EXPECT--
17+
array(0) {
18+
}
19+
Done

0 commit comments

Comments
 (0)