[GIT-PULLS] [php-src] PR #22874: Make PDO connection construction single-shot
[email protected] (iliaal) Thu, 23 Jul 2026 15:50:35 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <mZvQNDITIEpRxEJlWV9OD5TqEeXY2txVVRBbQZdEIaE@main.internal.php.net> |
Pull Request: https://github.com/php/php-src/pull/22874
Author: iliaal
Constructing a PDO over an already constructed handle re-runs connection setup and, for a persistent connection, frees the pemalloc'd dbh with efree(), corrupting the heap. The same sink is also reachable by reentering __construct() from a uri: DSN stream wrapper or a failed connect()'s destructor, and by retrying a persistent construct that failed after swapping in the handle. This makes construction single-shot: an is_constructing flag (an ABI-neutral bit taken from _reserved_flags, sizeof(pdo_dbh_t) unchanged) is set as soon as the handle exists for both __construct() and connect(), and construction is rejected once the driver is attached or one is already in progress. Behavior change: a construct that fails now leaves the handle unusable instead of allowing a retry.
$pdo = new PDO('sqlite::memory:', null, null, [PDO::ATTR_PERSISTENT => true]);
$pdo->__construct('sqlite::memory:', null, null, [PDO::ATTR_PERSISTENT => true]); // heap corruption before this change