[GIT-PULLS] [php-src] PR #22874: Make PDO connection construction single-shot

[email protected] (iliaal) Thu, 23 Jul 2026 15:50:35 +0000
Newsgroups php.git-pulls
Message-ID <mZvQNDITIEpRxEJlWV9OD5TqEeXY2txVVRBbQZdEIaE@main.internal.php.net>
Pull Request: https://github.com/php/php-src/pull/22874
Author: iliaal

Constructing a PDO over an already constructed handle re-runs connection setup and, for a persistent connection, frees the pemalloc'd dbh with efree(), corrupting the heap. The same sink is also reachable by reentering __construct() from a uri: DSN stream wrapper or a failed connect()'s destructor, and by retrying a persistent construct that failed after swapping in the handle. This makes construction single-shot: an is_constructing flag (an ABI-neutral bit taken from _reserved_flags, sizeof(pdo_dbh_t) unchanged) is set as soon as the handle exists for both __construct() and connect(), and construction is rejected once the driver is attached or one is already in progress. Behavior change: a construct that fails now leaves the handle unusable instead of allowing a retry.

    $pdo = new PDO('sqlite::memory:', null, null, [PDO::ATTR_PERSISTENT => true]);
    $pdo->__construct('sqlite::memory:', null, null, [PDO::ATTR_PERSISTENT => true]); // heap corruption before this change