Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ext/pdo: Convert FETCH_INTO zval to a zend_object pointer #17525

Merged
merged 2 commits into from
Jan 24, 2025
+17 −12
Merged

ext/pdo: Convert FETCH_INTO zval to a zend_object pointer #17525

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
842f8ef
ext/pdo: Convert FETCH_INTO zval to a zend_object pointer
Girgias Jan 19, 2025
5c79c03
Review
Girgias Jan 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 15 additions & 11 deletions ext/pdo/pdo_stmt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -836,14 +836,14 @@ static bool do_fetch(pdo_stmt_t *stmt, zval *return_value, enum pdo_fetch_type h

case PDO_FETCH_INTO:
/* TODO: Make this an assertion and ensure this is true higher up? */
if (Z_ISUNDEF(stmt->fetch.into)) {
if (stmt->fetch.into == NULL) {
/* TODO ArgumentCountError? */
pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "No fetch-into object specified.");
return 0;
break;
}

ZVAL_COPY(return_value, &stmt->fetch.into);
ZVAL_OBJ_COPY(return_value, stmt->fetch.into);

if (Z_OBJ_P(return_value)->ce == ZEND_STANDARD_CLASS_DEF_PTR) {
how = PDO_FETCH_OBJ;
Expand Down Expand Up @@ -1655,9 +1655,9 @@ bool pdo_stmt_setup_fetch_mode(pdo_stmt_t *stmt, zend_long mode, uint32_t mode_a

switch (stmt->default_fetch_type) {
case PDO_FETCH_INTO:
if (!Z_ISUNDEF(stmt->fetch.into)) {
zval_ptr_dtor(&stmt->fetch.into);
ZVAL_UNDEF(&stmt->fetch.into);
if (stmt->fetch.into) {
OBJ_RELEASE(stmt->fetch.into);
stmt->fetch.into = NULL;
}
break;
default:
Expand Down Expand Up @@ -1786,7 +1786,8 @@ bool pdo_stmt_setup_fetch_mode(pdo_stmt_t *stmt, zend_long mode, uint32_t mode_a
return false;
}

ZVAL_COPY(&stmt->fetch.into, &args[0]);
GC_ADDREF(Z_OBJ(args[0]));
stmt->fetch.into = Z_OBJ(args[0]);
break;
default:
zend_argument_value_error(mode_arg_num, "must be one of the PDO::FETCH_* constants");
Expand Down Expand Up @@ -2030,7 +2031,11 @@ static HashTable *dbstmt_get_gc(zend_object *object, zval **gc_data, int *gc_cou

zend_get_gc_buffer *gc_buffer = zend_get_gc_buffer_create();
zend_get_gc_buffer_add_zval(gc_buffer, &stmt->database_object_handle);
zend_get_gc_buffer_add_zval(gc_buffer, &stmt->fetch.into);
if ((stmt->default_fetch_type & PDO_FETCH_INTO) == PDO_FETCH_INTO) {
zend_get_gc_buffer_add_obj(gc_buffer, stmt->fetch.into);
} else if ((stmt->default_fetch_type & PDO_FETCH_CLASS) == PDO_FETCH_CLASS) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using a bitwise AND here seems wrong, as they're not bitmasks, so you're going to hit the condition for more than just PDO_FETCH_INTO or PDO_FETCH_CLASS.
See

php-src/ext/pdo/php_pdo_driver.h

Lines 66 to 81 in 8ed0d7f

enum pdo_fetch_type {
PDO_FETCH_USE_DEFAULT,
PDO_FETCH_LAZY,
PDO_FETCH_ASSOC,
PDO_FETCH_NUM,
PDO_FETCH_BOTH,
PDO_FETCH_OBJ,
PDO_FETCH_BOUND, /* return true/false only; rely on bound columns */
PDO_FETCH_COLUMN, /* fetch a numbered column only */
PDO_FETCH_CLASS, /* create an instance of named class, call ctor and set properties */
PDO_FETCH_INTO, /* fetch row into an existing object */
PDO_FETCH_FUNC, /* fetch into function and return its result */
PDO_FETCH_NAMED, /* like PDO_FETCH_ASSOC, but can handle duplicate names */
PDO_FETCH_KEY_PAIR, /* fetch into an array where the 1st column is a key and all subsequent columns are values */
PDO_FETCH__MAX /* must be last */
};

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem is that the default_fetch_type is a union of the fetch mode, with the fetch flags. I could bitwise not it with PDO_FETCH_FLAGS to separate out the flags from the mode as a bunch of other places do it.

Copy link
Member

@nielsdos nielsdos Jan 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay I remember now, but it's still wrong: you should AND with ~PDO_FETCH_FLAGS otherwise the following can happen:

Known: PDO_FETCH_CLASS equals 8 (0b1000), PDO_FETCH_INTO equals 9 (0b1001).
Problem example: let's say default_fetch_type is PDO_FETCH_INTO, and we look at the condition (stmt->default_fetch_type & PDO_FETCH_CLASS) == PDO_FETCH_CLASS. This condition expands to: (0b1001 & 0b1000) == 0b1000. We know that 0b1001 & 0b1000 is 0b1000, so it will be equal to PDO_FETCH_CLASS even though that's not what we want. In this particular case you don't run into it because of the ordering of the branches but that's extremely fragile and I'm sure you can come up with another combination of modes to trigger this kind of behaviour.

zend_get_gc_buffer_add_zval(gc_buffer, &stmt->fetch.cls.ctor_args);
}
zend_get_gc_buffer_use(gc_buffer, gc_data, gc_count);

/**
Expand Down Expand Up @@ -2077,9 +2082,9 @@ PDO_API void php_pdo_free_statement(pdo_stmt_t *stmt)

pdo_stmt_reset_columns(stmt);

if (!Z_ISUNDEF(stmt->fetch.into) && stmt->default_fetch_type == PDO_FETCH_INTO) {
zval_ptr_dtor(&stmt->fetch.into);
ZVAL_UNDEF(&stmt->fetch.into);
if (stmt->fetch.into && stmt->default_fetch_type == PDO_FETCH_INTO) {
OBJ_RELEASE(stmt->fetch.into);
stmt->fetch.into = NULL;
}

do_fetch_opt_finish(stmt, 1);
Expand Down Expand Up @@ -2168,7 +2173,6 @@ static void pdo_stmt_iter_move_forwards(zend_object_iterator *iter)

if (!do_fetch(stmt, &I->fetch_ahead, PDO_FETCH_USE_DEFAULT,
PDO_FETCH_ORI_NEXT, /* offset */ 0, NULL)) {

PDO_HANDLE_STMT_ERR();
I->key = (zend_ulong)-1;
ZVAL_UNDEF(&I->fetch_ahead);
Expand Down
2 changes: 1 addition & 1 deletion ext/pdo/php_pdo_driver.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -621,7 +621,7 @@ struct _pdo_stmt_t {
zval dummy; /* This exists due to alignment reasons with fetch.into and fetch.cls.ctor_args */
zend_fcall_info_cache fcc;
} func;
zval into;
zend_object *into;
} fetch;

/* used by the query parser for driver specific
Expand Down
Loading