Skip to content

Commit 58a6e55

Browse files
committed
Merge branch 'PHP-8.3'
2 parents c66221b + 1b71a9e commit 58a6e55

File tree

3 files changed

+32
-1
lines changed

3 files changed

+32
-1
lines changed

Zend/zend_execute.c

+3
Original file line numberDiff line numberDiff line change
@@ -3280,6 +3280,9 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
32803280
}
32813281
}
32823282

3283+
/* Pointer on property callback is required */
3284+
ZEND_ASSERT(zobj->handlers->get_property_ptr_ptr != NULL);
3285+
32833286
if (prop_op_type == IS_CONST) {
32843287
name = Z_STR_P(prop_ptr);
32853288
} else {

ext/pdo/pdo_stmt.c

+11-1
Original file line numberDiff line numberDiff line change
@@ -2449,6 +2449,16 @@ static zend_function *row_get_ctor(zend_object *object)
24492449
return NULL;
24502450
}
24512451

2452+
static zval *pdo_row_get_property_ptr_ptr(zend_object *object, zend_string *name, int type, void **cache_slot)
2453+
{
2454+
ZEND_IGNORE_VALUE(object);
2455+
ZEND_IGNORE_VALUE(name);
2456+
ZEND_IGNORE_VALUE(type);
2457+
ZEND_IGNORE_VALUE(cache_slot);
2458+
2459+
return NULL;
2460+
}
2461+
24522462
void pdo_row_free_storage(zend_object *std)
24532463
{
24542464
pdo_row_t *row = (pdo_row_t *)std;
@@ -2489,7 +2499,7 @@ void pdo_stmt_init(void)
24892499
memcpy(&pdo_row_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));
24902500
pdo_row_object_handlers.free_obj = pdo_row_free_storage;
24912501
pdo_row_object_handlers.clone_obj = NULL;
2492-
pdo_row_object_handlers.get_property_ptr_ptr = NULL;
2502+
pdo_row_object_handlers.get_property_ptr_ptr = pdo_row_get_property_ptr_ptr;
24932503
pdo_row_object_handlers.read_property = row_prop_read;
24942504
pdo_row_object_handlers.write_property = row_prop_write;
24952505
pdo_row_object_handlers.has_property = row_prop_exists;

ext/pdo_sqlite/tests/gh14712.phpt

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
GH-14712: segfault on PDORow
3+
--EXTENSIONS--
4+
pdo_sqlite
5+
--CREDITS--
6+
YuanchengJiang
7+
--FILE--
8+
<?php
9+
$db = new PDO('sqlite::memory:');
10+
11+
try {
12+
$db->query("select 1 as queryStringxx")->fetch(PDO::FETCH_LAZY)->documentElement->firstChild->nextElementSibling->textContent = "é";
13+
} catch (Error $e) {
14+
echo $e->getMessage();
15+
}
16+
?>
17+
--EXPECT--
18+
Attempt to modify property "firstChild" on null

0 commit comments

Comments
 (0)