Skip to content

ext/odbc: Fix GH-25036 double free on parameter description failure - #25044

Closed
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/gh-25036-odbc-prepare-double-free
Closed

iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/gh-25036-odbc-prepare-double-free

Conversation

@iliaal

@iliaal iliaal commented Oct 29, 2026

Copy link
Copy Markdown
Member

odbc_prepare() now registers results before describing parameters and releases them through odbc_result_free() when SQLDescribeParam() fails, preventing a double free and removal of another live result from the connection. Reported with the Windows {SQL Server} driver; verified locally with psqlODBC and PostgreSQL 16, including Valgrind.

Fixes GH-25036

…ails

odbc_prepare() set conn_ptr before describing the parameters but registered
the result in conn->results only afterwards. When SQLDescribeParam() failed,
the error branch freed param_info, then the object destructor freed it again
in odbc_result_free() and deleted index 0 from conn->results, unregistering
whichever live result held that slot. Register the result as soon as
conn_ptr is set, as the other result-producing functions do, and release it
through odbc_result_free() on failure.

Fixes phpGH-25036

@NattyNarwhal NattyNarwhal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks correct. The eager use of the implicit return_value (and mixing it with result unwrapped from that) I think makes this function a bit more confusing looking than it should be, but can clean that up in a followup PR.

@iliaal iliaal closed this in 083e1a6 Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants