diff options
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/sqlite3/sqlite3.c | 4 | ||||
| -rw-r--r-- | ext/sqlite3/tests/bug72571.phpt | 21 |
3 files changed, 27 insertions, 1 deletions
@@ -19,6 +19,9 @@ PHP NEWS - SPL: . Fixed bug #55701 (GlobIterator throws LogicException). (Valentin VĂLCIU) +- SQLite3: + . Fixed bug #72571 (SQLite3::bindValue, SQLite3::bindParam crash). (Laruence) + - Standard: . Fixed bug #72152 (base64_decode $strict fails to detect null byte). (Lauri Kenttä) diff --git a/ext/sqlite3/sqlite3.c b/ext/sqlite3/sqlite3.c index 9436c158b5..0e0ef09d25 100644 --- a/ext/sqlite3/sqlite3.c +++ b/ext/sqlite3/sqlite3.c @@ -1394,7 +1394,9 @@ static int register_bound_parameter_to_sqlite(struct php_sqlite3_bound_param *pa } if (param->param_number < 1) { - zend_string_release(param->name); + if (param->name) { + zend_string_release(param->name); + } return 0; } diff --git a/ext/sqlite3/tests/bug72571.phpt b/ext/sqlite3/tests/bug72571.phpt new file mode 100644 index 0000000000..3ffde291c7 --- /dev/null +++ b/ext/sqlite3/tests/bug72571.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #72571 (SQLite3::bindValue, SQLite3::bindParam crash) +--SKIPIF-- +<?php +if (!extension_loaded('sqlite3')) die('skip'); ?> +--FILE-- +<?php +$db = new SQLite3(':memory:'); + +$stmt = $db->prepare("select 1 = ?"); + +// bindParam crash +$i = 0; +$stmt->bindParam(0, $i); + +var_dump($stmt->execute()); +$db->close(); +?> +--EXPECTF-- +object(SQLite3Result)#%d (0) { +} |