[PDO] Fix leak of driver_params argument of bindParam() and bindColumn()

NEWS

@@ -8,6 +8,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23301 (Nested "yield from" yields a value twice when the
     middle generator delegates again). (Lazizbek Ergashev)
 
+- CLI:
+  . Fixed bug GH-23425 (sapi_cli_server_send_headers() does not check the
+    return value of php_cli_server_client_send_through()). (Lazizbek Ergashev)
+
 - DOM:
   . Fixed a use-after-free when cloning a DOMNameSpaceNode after
     DOMDocument::xinclude(). (iliaal)
@@ -28,6 +32,8 @@ PHP                                                                        NEWS
   . Fixed Locale::parseLocale() reading past a trailing '-' or '_'.
     (iliaal, Xuyang Zhang)
   . Fixed grapheme_str_split() treating UBRK_DONE as a byte index. (iliaal)
+  . Fixed a leak in Locale::getKeywords() when a keyword value cannot be
+    read. (iliaal)
 
 - Opcache:
   . Fixed opcache.protect_memory race under ZTS. (realFlowControl)
@@ -46,6 +52,8 @@ PHP                                                                        NEWS
     an object converted to an array fails. (David Carlier)
 
 - Zip:
+  . Fixed bug GH-23276 (ZipArchive subclass storing its own stream cannot be
+    garbage collected). (Weilin Du, ndossche)
   . Fixed ZipArchive::extractTo() and ZipArchive::getFrom*() reporting success
     on corrupted entries. (David Carlier)
 

ext/intl/locale/locale_methods.c

@@ -776,6 +776,7 @@ PHP_FUNCTION( locale_get_keywords )
 					zend_string_efree( kw_value_str );
 				}
 				zend_array_destroy(Z_ARR_P(return_value));
+				uenum_close( e );
 				RETURN_FALSE;
 			}
 

ext/intl/tests/locale_get_keywords_failure.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Locale::getKeywords() closes the keyword enumeration on failure
+--EXTENSIONS--
+intl
+--SKIPIF--
+<?php
+if (version_compare(INTL_ICU_VERSION, '59.1', '<')) {
+    die('skip for ICU >= 59.1');
+}
+?>
+--FILE--
+<?php
+var_dump(Locale::getKeywords('en@foo=bar!'));
+var_dump(intl_get_error_code() === U_ILLEGAL_ARGUMENT_ERROR);
+?>
+--EXPECT--
+bool(false)
+bool(true)

ext/pdo/pdo_stmt.c

@@ -330,6 +330,7 @@ static bool really_register_bound_param(struct pdo_bound_param_data *param, pdo_
 			zend_string_release_ex(param->name, 0);
 			param->name = NULL;
 		}
+		zval_ptr_dtor(&param->driver_params);
 		return 0;
 	}
 
@@ -344,6 +345,7 @@ static bool really_register_bound_param(struct pdo_bound_param_data *param, pdo_
 				zend_string_release_ex(param->name, 0);
 				param->name = NULL;
 			}
+			zval_ptr_dtor(&param->driver_params);
 			return 0;
 		}
 	}
@@ -1461,9 +1463,11 @@ static void register_bound_param(INTERNAL_FUNCTION_PARAMETERS, int is_param) /*
 		if (!Z_ISUNDEF(param.parameter)) {
 			zval_ptr_dtor(&(param.parameter));
 		}
+		zval_ptr_dtor(&param.driver_params);
 
 		RETURN_FALSE;
 	}
+	zval_ptr_dtor(&param.driver_params);
 
 	RETURN_TRUE;
 } /* }}} */

ext/pdo/tests/bug_driver_params_leak.phpt

@@ -0,0 +1,81 @@
+--TEST--
+PDO: bindParam() must not leak driver_params
+--EXTENSIONS--
+pdo
+pdo_sqlite
+--FILE--
+<?php
+class C {}
+$db = new PDO('sqlite::memory:');
+$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+$stmt = $db->prepare('SELECT ?');
+
+$n = 20000;
+for ($i = 0; $i < $n; $i++) {
+    $dp = str_repeat('a', 1024);
+    $obj = new C();
+    try {
+        $stmt->bindParam(1, $obj, PDO::PARAM_STR, 0, $dp);
+    } catch (Error $e) {
+    }
+}
+$before = memory_get_usage();
+for ($i = 0; $i < $n; $i++) {
+    $dp = str_repeat('b', 1024);
+    $obj = new C();
+    try {
+        $stmt->bindParam(1, $obj, PDO::PARAM_STR, 0, $dp);
+    } catch (Error $e) {
+    }
+}
+$diff = memory_get_usage() - $before;
+if ($diff > 1000) {
+    echo "LEAK\n";
+} else {
+    echo "OK\n";
+}
+
+$stmt2 = $db->prepare('SELECT :bar');
+$v = 'x';
+for ($i = 0; $i < $n; $i++) {
+    $dp = str_repeat('c', 1024);
+    try {
+        $stmt2->bindParam(':missing', $v, PDO::PARAM_STR, 0, $dp);
+    } catch (PDOException $e) {
+    }
+}
+$before = memory_get_usage();
+for ($i = 0; $i < $n; $i++) {
+    $dp = str_repeat('d', 1024);
+    try {
+        $stmt2->bindParam(':missing', $v, PDO::PARAM_STR, 0, $dp);
+    } catch (PDOException $e) {
+    }
+}
+$diff = memory_get_usage() - $before;
+if ($diff > 1000) {
+    echo "LEAK\n";
+} else {
+    echo "OK\n";
+}
+
+for ($i = 0; $i < $n; $i++) {
+    $dp = str_repeat('e', 1024);
+    $stmt->bindParam(1, $v, PDO::PARAM_STR, 0, $dp);
+}
+$before = memory_get_usage();
+for ($i = 0; $i < $n; $i++) {
+    $dp = str_repeat('f', 1024);
+    $stmt->bindParam(1, $v, PDO::PARAM_STR, 0, $dp);
+}
+$diff = memory_get_usage() - $before;
+if ($diff > 1000) {
+    echo "LEAK\n";
+} else {
+    echo "OK\n";
+}
+?>
+--EXPECT--
+OK
+OK
+OK