Merge branch 'PHP-8.6'

Author: iliaal

ext/odbc/php_odbc.c

@@ -952,21 +952,19 @@ PHP_FUNCTION(odbc_prepare)
 	}
 	result->conn_ptr = conn;
 	result->fetched = 0;
+	odbc_insert_new_result(conn, return_value);
 
 	result->param_info = (odbc_param_info *) safe_emalloc(sizeof(odbc_param_info), result->numparams, 0);
 	for (i=0;i<result->numparams;i++) {
 		rc = SQLDescribeParam(result->stmt, (SQLUSMALLINT)(i+1), &result->param_info[i].sqltype, &result->param_info[i].precision,
 													&result->param_info[i].scale, &result->param_info[i].nullable);
 		if (rc == SQL_ERROR) {
 			odbc_sql_error(result->conn_ptr, result->stmt, "SQLDescribeParameter");
-			SQLFreeStmt(result->stmt, SQL_RESET_PARAMS);
-			efree(result->param_info);
+			odbc_result_free(result);
 			zval_ptr_dtor(return_value);
 			RETURN_FALSE;
 		}
 	}
-
-	odbc_insert_new_result(conn, return_value);
 }
 /* }}} */
 

ext/odbc/tests/gh25036.phpt

@@ -0,0 +1,39 @@
+--TEST--
+GH-25036 (odbc_prepare() double free when SQLDescribeParam() fails)
+--EXTENSIONS--
+odbc
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+
+include 'config.inc';
+
+$conn = odbc_connect($dsn, $user, $pass);
+
+$live = odbc_exec($conn, 'SELECT 1 AS a');
+
+var_dump(odbc_prepare($conn, 'SELECT ? FROM gh25036_missing'));
+var_dump(odbc_prepare($conn, 'SELECT ?, ? FROM gh25036_missing'));
+
+var_dump(odbc_fetch_array($live));
+
+odbc_close($conn);
+
+try {
+    odbc_fetch_row($live);
+} catch (Error $e) {
+    echo $e::class, ": ", $e->getMessage(), PHP_EOL;
+}
+?>
+--EXPECTF--
+Warning: odbc_prepare(): SQL error: %s, SQL state %s in SQLDescribeParameter in %s on line %d
+bool(false)
+
+Warning: odbc_prepare(): SQL error: %s, SQL state %s in SQLDescribeParameter in %s on line %d
+bool(false)
+array(1) {
+  ["a"]=>
+  string(1) "1"
+}
+Error: ODBC result has already been closed