Skip to content

ext/pdo_firebird: Fixed GH-18276 - persistent connection - "zend_mm_heap corrupted" with setAttribute() #18280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

ext/pdo_firebird: Fixed GH-18276 - persistent connection - "zend_mm_heap corrupted" with setAttribute() #18280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1c25919
Added a test
SakiTakamachi Apr 8, 2025
3bf28c7
When freeing memory, set the pointer to NULL.
SakiTakamachi Apr 8, 2025
8d15cdb
Allocate and free memory properly
SakiTakamachi Apr 9, 2025
af6528e
address comments
SakiTakamachi Apr 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 12 additions & 9 deletions ext/pdo_firebird/firebird_driver.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -492,13 +492,13 @@ static void firebird_handle_closer(pdo_dbh_t *dbh) /* {{{ */
}

if (H->date_format) {
efree(H->date_format);
pefree(H->date_format, dbh->is_persistent);
}
if (H->time_format) {
efree(H->time_format);
pefree(H->time_format, dbh->is_persistent);
}
if (H->timestamp_format) {
efree(H->timestamp_format);
pefree(H->timestamp_format, dbh->is_persistent);
}

pefree(H, dbh->is_persistent);
Expand Down Expand Up @@ -881,9 +881,10 @@ static bool firebird_handle_set_attribute(pdo_dbh_t *dbh, zend_long attr, zval *
return false;
}
if (H->date_format) {
efree(H->date_format);
pefree(H->date_format, dbh->is_persistent);
H->date_format = NULL;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm okay with these being set to NULL because technically we could bail out if the pestrdup below fails.

}
spprintf(&H->date_format, 0, "%s", ZSTR_VAL(str));
H->date_format = pestrndup(ZSTR_VAL(str), ZSTR_LEN(str),dbh->is_persistent);
zend_string_release_ex(str, 0);
}
return true;
Expand All @@ -895,9 +896,10 @@ static bool firebird_handle_set_attribute(pdo_dbh_t *dbh, zend_long attr, zval *
return false;
}
if (H->time_format) {
efree(H->time_format);
pefree(H->time_format, dbh->is_persistent);
H->time_format = NULL;
}
spprintf(&H->time_format, 0, "%s", ZSTR_VAL(str));
H->time_format = pestrndup(ZSTR_VAL(str), ZSTR_LEN(str),dbh->is_persistent);
zend_string_release_ex(str, 0);
}
return true;
Expand All @@ -909,9 +911,10 @@ static bool firebird_handle_set_attribute(pdo_dbh_t *dbh, zend_long attr, zval *
return false;
}
if (H->timestamp_format) {
efree(H->timestamp_format);
pefree(H->timestamp_format, dbh->is_persistent);
H->timestamp_format = NULL;
}
spprintf(&H->timestamp_format, 0, "%s", ZSTR_VAL(str));
H->timestamp_format = pestrndup(ZSTR_VAL(str), ZSTR_LEN(str),dbh->is_persistent);
zend_string_release_ex(str, 0);
}
return true;
Expand Down
35 changes: 35 additions & 0 deletions ext/pdo_firebird/tests/gh18276.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
--TEST--
GH-18276 (persistent connection - setAttribute(Pdo\Firebird::ATTR_DATE_FORMAT, ..) results in "zend_mm_heap corrupted")
--EXTENSIONS--
pdo_firebird
--SKIPIF--
<?php require('skipif.inc'); ?>
--XLEAK--
A bug in firebird causes a memory leak when calling `isc_attach_database()`.
See https://github.com/FirebirdSQL/firebird/issues/7849
--FILE--
<?php

require("testdb.inc");
unset($dbh);

for ($i = 0; $i < 2; $i++) {
$dbh = new PDO(
PDO_FIREBIRD_TEST_DSN,
PDO_FIREBIRD_TEST_USER,
PDO_FIREBIRD_TEST_PASS,
[
PDO::ATTR_PERSISTENT => true,
],
);
// Avoid interned
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

str_repeat is special cased in the SCCP optimization pass if you have a constant number as a second argument, and so you'll still get an interned string here.
You need to do this: str_repeat('my string', random_int(1, 1));

$dbh->setAttribute(PDO::FB_ATTR_DATE_FORMAT, str_repeat('Y----m----d', random_int(1, 1)));
$dbh->setAttribute(PDO::FB_ATTR_TIME_FORMAT, str_repeat('H::::i::::s', random_int(1, 1)));
$dbh->setAttribute(PDO::FB_ATTR_TIMESTAMP_FORMAT, str_repeat('Y----m----d....H::::i::::s', random_int(1, 1)));
unset($dbh);
}

echo 'done!';
?>
--EXPECT--
done!
Loading