diff options
author | Christoph M. Becker <cmbecker69@gmx.de> | 2019-12-27 13:20:11 +0100 |
---|---|---|
committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-02-17 22:53:02 +0100 |
commit | 08073b06581c6dc9234cfb2e9b187a598154c8ab (patch) | |
tree | 01422c7c3a6418e3abb0dd835c5d95fd42b8e9db /ext/sqlite3/php_sqlite3_structs.h | |
parent | 16c7c716937f7cd5bfae19063772898dd8644de3 (diff) | |
download | php-git-08073b06581c6dc9234cfb2e9b187a598154c8ab.tar.gz |
Fix #79038: PDOStatement::nextRowset() leaks column values
Firstly, we must not rely on `stmt->column_count` when freeing the
driver specific column values, but rather store the column count in
the driver data. Since the column count is a `short`, 16 bit are
sufficient, so we can store it in reserved bits of `pdo_odbc_stmt`.
Furthermore, we must not allocate new column value storage when the
statement is not executed, but rather when the column value storage has
not been allocated.
Finally, we have to introduce a driver specific `cursor_closer` to
avoid that `::closeCursor()` calls `odbc_stmt_next_rowset()` which then
frees the column value storage, because it may be still needed for
bound columns.
Diffstat (limited to 'ext/sqlite3/php_sqlite3_structs.h')
0 files changed, 0 insertions, 0 deletions