archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

PDO MySQL: Check number of bounds params even if none are bound

Browse source 
The check for the number of bound parameters was only executed if
at least one was bound. We should also error if nothing was bound.
With mysqlnd, mysqlnd itself ended up emitting an error, but with
libmysqlclient this error condition would not be detected.
This commit is contained in:
Nikita Popov 2021-05-17 14:29:47 +02:00
parent 7ba0c74312
commit ec56650801
2 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
ext/pdo_mysql/mysql_statement.c
View file

@ -315,6 +315,15 @@ static int pdo_mysql_stmt_execute(pdo_stmt_t *stmt) /* {{{ */
S->done = 0;
if (S->stmt) {
uint32_t num_bound_params =
stmt->bound_params ? zend_hash_num_elements(stmt->bound_params) : 0;
if (num_bound_params < (uint32_t) S->num_params) {
/* too few parameter bound */
PDO_DBG_ERR("too few parameters bound");
strcpy(stmt->error_code, "HY093");
PDO_DBG_RETURN(0);
}
PDO_DBG_RETURN(pdo_mysql_stmt_execute_prepared(stmt));
}
@ -403,13 +412,6 @@ static int pdo_mysql_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_da
PDO_DBG_RETURN(1);
case PDO_PARAM_EVT_EXEC_PRE:
if (zend_hash_num_elements(stmt->bound_params) < (unsigned int) S->num_params) {
/* too few parameter bound */
PDO_DBG_ERR("too few parameters bound");
strcpy(stmt->error_code, "HY093");
PDO_DBG_RETURN(0);
}
if (!Z_ISREF(param->parameter)) {
parameter = &param->parameter;
} else {

2
ext/pdo_mysql/tests/bug81037.phpt
View file

@ -32,4 +32,4 @@ require __DIR__ . '/mysql_pdo_test.inc';
MySQLPDOTest::dropTestTable();
?>
--EXPECT--
SQLSTATE[HY000]: General error: 2031 No data supplied for parameters in prepared statement
SQLSTATE[HY093]: Invalid parameter number