Skip to content

Fix memory leak of pdo_odbc output parameter buffer#22734

Closed
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/pdo-odbc-outbuf-leak
Closed

Fix memory leak of pdo_odbc output parameter buffer#22734
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/pdo-odbc-outbuf-leak

Conversation

@iliaal

@iliaal iliaal commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

odbc_stmt_param_hook() emallocs P->outbuf for output and INPUT_OUTPUT parameters at PDO_PARAM_EVT_ALLOC, hands it to the driver with SQLBindParameter, and never frees it. The buffer outlives the bound-parameter struct (PDO destroys that mid-statement on execute($array) or when a position is rebound), so it cannot be freed at parameter-free time without leaving the ODBC statement pointing at freed memory. Track the allocated buffers on the statement and free them in the destructor, after SQLFreeHandle has dropped the bindings.

Reproducer, leaks under a debug or ASAN build:

$pdo = new PDO('odbc:Driver=SQLite3;Database=:memory:');
$stmt = $pdo->prepare('SELECT ? AS v');
$var = 'seed';
$stmt->bindParam(1, $var, PDO::PARAM_STR | PDO::PARAM_INPUT_OUTPUT, 256);
$stmt->execute();

odbc_stmt_param_hook() allocates P->outbuf via emalloc for output and
INPUT_OUTPUT parameters at PDO_PARAM_EVT_ALLOC, but nothing ever frees it.
The buffer is handed to the driver with SQLBindParameter and outlives the
bound-parameter struct, which PDO destroys mid-statement on execute with an
array or on rebinding a position. Track the buffers on the statement and
release them in the destructor, after SQLFreeHandle has dropped the
bindings, so the leak is fixed without freeing a buffer the driver may
still reference.
@iliaal

iliaal commented Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #22735, which fixes this leak together with a related stale-binding out-of-bounds read in the same parameter-binding code. Closing in favour of that one.

@iliaal iliaal closed this Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant