Fixed bug #35303 (PDO prepare() crashes with invalid parameters).

Author: Ilia Alshanetsky

NEWS

@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Nov 2005, PHP 5.1
+- Fixed bug #35303 (PDO prepare() crashes with invalid parameters). (Ilia)
 - Fixed bug #35293 (PDO segfaults when using persistent connections). (Tony)
 - Fixed bug #35278 (Multiple virtual() calls crash Apache 2 php module). (Ilia)
 - Fixed bug #35273 (Error in mapping soap - java types). (Dmitry)

ext/pdo/pdo_dbh.c

@@ -503,7 +503,7 @@ static PHP_METHOD(PDO, prepare)
 	PDO_CONSTRUCT_CHECK;
 
 	if (ZEND_NUM_ARGS() > 1 && SUCCESS == zend_hash_index_find(Z_ARRVAL_P(options), PDO_ATTR_STATEMENT_CLASS, (void**)&opt)) {
-		if (zend_hash_index_find(Z_ARRVAL_PP(opt), 0, (void**)&item) == FAILURE
+		if (Z_TYPE_PP(opt) != IS_ARRAY || zend_hash_index_find(Z_ARRVAL_PP(opt), 0, (void**)&item) == FAILURE
 			|| Z_TYPE_PP(item) != IS_STRING
 			|| zend_lookup_class(Z_STRVAL_PP(item), Z_STRLEN_PP(item), &pce TSRMLS_CC) == FAILURE
 		) {