[GIT-PULLS] [php-src] PR #22734: Fix memory leak of pdo_odbc output parameter buffer
[email protected] (iliaal)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22734
Author: iliaal
`odbc_stmt_param_hook()` emallocs `P->outbuf` for output and INPUT_OUTPUT parameters at `PDO_PARAM_EVT_ALLOC`, hands it to the driver with `SQLBindParameter`, and never frees it. The buffer outlives the bound-parameter struct (PDO destroys that mid-statement on `execute($array)` or when a position is rebound), so it cannot be freed at parameter-free time without leaving the ODBC statement pointing at freed memory. Track the allocated buffers on the statement and free them in the destructor, after `SQLFreeHandle` has dropped the bindings.
Reproducer, leaks under a debug or ASAN build:
```php
$pdo = new PDO('odbc:Driver=SQLite3;Database=:memory:');
$stmt = $pdo->prepare('SELECT ? AS v');
$var = 'seed';
$stmt->bindParam(1, $var, PDO::PARAM_STR | PDO::PARAM_INPUT_OUTPUT, 256);
$stmt->execute();
```