Skip to content

Fix GH-25036: odbc_prepare() double free when SQLDescribeParam() fails - #447

Closed
iliaal wants to merge 1 commit into
PHP-8.4from
fix/gh-25036-odbc-prepare-double-free
Closed

iliaal wants to merge 1 commit into
PHP-8.4from
fix/gh-25036-odbc-prepare-double-free

Conversation

@iliaal

@iliaal iliaal commented Oct 29, 2026 •

Copy link
Copy Markdown
Owner

When SQLDescribeParam() failed, odbc_prepare() freed param_info and the result's destructor freed it again, also deleting index 0 from conn->results, a slot the result never owned. The result is now registered as soon as conn_ptr is set, like every other function that creates an Odbc\Result, and released through odbc_result_free() on failure.

Reported against the Windows {SQL Server} driver; reproduced and verified on Linux with psqlodbc and PostgreSQL 16, not against SQL Server.

Fixes php#25036

…ails

odbc_prepare() set conn_ptr before describing the parameters but registered
the result in conn->results only afterwards. When SQLDescribeParam() failed,
the error branch freed param_info, then the object destructor freed it again
in odbc_result_free() and deleted index 0 from conn->results, unregistering
whichever live result held that slot. Register the result as soon as
conn_ptr is set, as the other result-producing functions do, and release it
through odbc_result_free() on failure.

Fixes phpGH-25036
@iliaal

iliaal commented Oct 29, 2026

Copy link
Copy Markdown
Owner Author

Promoted upstream: php#25044

@iliaal iliaal closed this Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant