596 Commits
Author SHA1 Message Date
Ilia Alshanetsky cb28aa03d5 Merge branch 'PHP-8.6'
* PHP-8.6:
  Fix HashTable UAF when rebound from a parameter __toString()
2026-09-30 08:51:00 -04:00
Ilia Alshanetsky f5c66773fd Merge branch 'PHP-8.5' into PHP-8.6
* PHP-8.5:
  Fix HashTable UAF when rebound from a parameter __toString()
2026-09-30 08:50:59 -04:00
Ilia Alshanetsky 9c20c86bcc Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix HashTable UAF when rebound from a parameter __toString()
2026-09-30 08:50:46 -04:00
Ilia Alshanetsky 08a49a9225 Fix HashTable UAF when rebound from a parameter __toString()
dispatch_param_event iterates bound_params with ZEND_HASH_FOREACH
while sqlite's EXEC_PRE hook can run __toString; execute() then
destroys the table and bindValue() replaces buckets. Steal one
_reserved bit as in_param_event (no layout size change; the header
is installed) and throw Error from bindParam, bindValue, bindColumn,
execute, and closeCursor while the hook is running. fetch is left
unguarded: nested FOREACH is read-only and FETCH_POST writes column
zvals, not the HashTable. 8.5/master already have a uint16_t
bitfield with in_fetch; the forward merge needs in_param_event:1
and reserved:11.

Closes GH-23252
2026-09-30 08:49:09 -04:00
Ilia Alshanetsky c91bf4758c Merge branch 'PHP-8.6'
* PHP-8.6:
  ext/pdo: Drop the previous result when execute() fails
2026-09-30 08:30:06 -04:00
Ilia Alshanetsky 1b81b8c03e Merge branch 'PHP-8.5' into PHP-8.6
* PHP-8.5:
  ext/pdo: Drop the previous result when execute() fails
2026-09-30 08:30:04 -04:00
Ilia Alshanetsky be4e9ee719 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  ext/pdo: Drop the previous result when execute() fails
2026-09-30 08:21:37 -04:00
Ilia Alshanetsky 11690db178 ext/pdo: Drop the previous result when execute() fails
PDOStatement::execute() returned false on a bind, parse, or driver
failure without clearing stmt->executed, so a later fetch returned rows
from the previous success. Close the previous result on entry, before
the error state is cleared, so a cursor closer that records an error
cannot replace the SQLSTATE of the failure execute() reports.

Closes GH-23938
2026-09-30 08:12:25 -04:00
Ilia Alshanetsky 7f1e8cb37b ext/pdo: Throw a ValueError from bindColumn() for an unknown column (#23835)
A column name that is not in the result set is a programming error, so
report it the way the method already reports an empty name or an index
below one, rather than through PDO::ATTR_ERRMODE. The equivalent parameter
failure in bindParam() and bindValue() stays an ERRMODE error: its site in
rewrite_name_to_position() is only reachable once execute() has populated
bound_param_map, never from the bind methods themselves.

Closes GH-23835
2026-09-29 11:38:23 -04:00
Ilia Alshanetsky fbeec51ac7 Merge branch 'PHP-8.5' into PHP-8.6
* PHP-8.5:
  ext/pdo: Release driver options after bindParam and bindColumn
2026-09-29 11:08:02 -04:00
Ilia Alshanetsky 8c225561bd Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  ext/pdo: Release driver options after bindParam and bindColumn
2026-09-29 10:59:47 -04:00
Ilia Alshanetsky 22237f2c07 ext/pdo: Release driver options after bindParam and bindColumn
bindParam() and bindColumn() copied the driver options zval and then
addref'd it again. The extra reference kept the value alive after the
statement was destroyed. Keep the single reference from the copy.

Closes GH-23936
2026-09-29 10:50:04 -04:00
Kamil Tekiela 7363aa21f1 Merge branch 'PHP-8.5' into PHP-8.6 2026-09-28 22:54:33 +01:00
Kamil Tekiela 228dd15a77 Merge branch 'PHP-8.4' into PHP-8.5 2026-09-28 22:54:08 +01:00
Lazizbek Ergashev 3109800122 Fix GH-23962: Don't roll back a persistent PDO handle still in use (#23963) 2026-09-28 22:52:45 +01:00
Ilia Alshanetsky 934d4ff95f Pin $this in zend_call_function (#22151)
zend_call_function() ran the callback with fci_cache->object as $this
without holding a reference, so a callback that released the last
reference to its own receiver (an autoloader unregistering itself, a
SQLite3 authorizer calling setAuthorizer(null)) freed $this while its
frame was still executing. Take the reference where the receiver is
selected rather than after argument setup, so the error handlers
reachable from the deprecation notice and the by-reference warning
cannot free it first, and release it on every early exit.

Fixes GH-22060
Fixes GH-22122
2026-09-21 17:32:32 -04:00
Marc Bennewitz 23fbd86fac PDO: Migrate maxlen of pdo_column_data from size_t to zend_long (#19144)
* PDO: Migrate maxlen of pdo_column_data from size_t to zend_long

* PDO_ODBC: use displaysize for maxlen and colsize for datalen
2026-08-31 13:42:58 -03:00
Ilia Alshanetsky 8f2d79e4d1 Honor ERRMODE_SILENT in pdo_raise_impl_error (#23070)
pdo_raise_impl_error stored the SQLSTATE then still emitted E_WARNING
even when the handle error mode was SILENT. The early return for SILENT
was present but disabled (#if 0). Copy the error code first so
errorInfo() remains valid, then return without warning.

Closes GH-23070
2026-08-10 08:10:02 -04:00
NickSdot 59ad209206 ext/pdo_sqlite: applied fixers to improve test robustness (#23032) 2026-08-07 19:29:50 +01:00
Nora Dossche b82fc3c0e0 Fix unchecked sqlite3_column_text() calls (#22715)
This is the pdo equivalent of GH-22045. Notably it does not include a
change for the blob call because ZVAL_STRINGL_FAST already takes care of
that implicitly.
2026-07-20 18:09:42 +02:00
Ilia Alshanetsky 5ce795bec1 Fix GH-20964: fseek() on php://memory with PHP_INT_MIN causes undefined behavior (#21433)
Negate after casting to unsigned instead of before, avoiding signed
integer overflow when offset is ZEND_LONG_MIN. The same pattern existed
in the pdo_sqlite and sqlite3 stream seek handlers.

Closes GH-20964
Closes GH-20927
2026-06-20 19:01:46 -04:00
Peter Kokot 61e62a4dc9 Update ext/{pdo_sqlite,sqlite3} tests (#21198)
- Added SKIPIF sections for tests that use Pdo\Sqlite::DETERMINISTIC
  as it is available since libsqlite 3.8.3.
- Removed outdated SKIPIF sections for libsqlite versions 3.7.4

When using libsqlite 3.7.17 there are two more failing tests due to
different warning messages:
- ext/sqlite3/tests/sqlite3_38_extended_error.phpt
- ext/sqlite3/tests/sqlite3_39_toggleExtended.phpt

This fix doesn't address these as minimum required libsqlite will be
updated in the future PHP versions anyway at some point and this won't
be an issue anymore then.
2026-04-28 18:58:51 +02:00
Ben Ramsey b943a1b030 license-update: ext/pdo_sqlite source headers
RFC: https://wiki.php.net/rfc/php_license_update
2026-04-11 21:20:54 -05:00
Ilija Tovilo 660996662a Switch sqlite tests from "" to '' and re-enable for FreeBSD
FreeBSD builds without DQS (double-quote support). Transform tests so we can
re-eanble them for FreeBSD. Add separate tests for DQS.

Closes GH-21495
2026-04-02 22:15:08 +02:00
Ilija Tovilo 073dcf66bb Merge branch 'PHP-8.5'
* PHP-8.5:
  Add RUN_RESOURCE_HEAVY_TESTS env var
2026-02-27 15:05:28 +01:00
Ilija Tovilo 07e29acbd4 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Add RUN_RESOURCE_HEAVY_TESTS env var
2026-02-27 15:05:21 +01:00
Ilija Tovilo 6f91209260 Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Add RUN_RESOURCE_HEAVY_TESTS env var
2026-02-27 15:05:14 +01:00
Ilija Tovilo c6ad84fb9e Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2:
  Add RUN_RESOURCE_HEAVY_TESTS env var
2026-02-27 15:04:24 +01:00
Ilija Tovilo 3a57b4ced5 Add RUN_RESOURCE_HEAVY_TESTS env var
Disable resource-heavy tests by default (>1GB of memory usage), unless the
RUN_RESOURCE_HEAVY_TESTS env variable is set.

Fixes GH-20762
Closes GH-20935
2026-02-27 15:00:35 +01:00
Peter Kokot 435e67e075 Remove HAVE_SQLITE3_{CLOSE_V2,ERRSTR} (#18963)
As of PHP 8.5 the minimum required SQLite library is 3.7.17, and this
removes the following preprocessor macros checks:

- HAVE_SQLITE3_CLOSE_V2 (sqlite3_close_v2() function is available since
  SQLite 3.7.14.)
- HAVE_SQLITE3_ERRSTR (sqlite3_errstr() function is available since
  SQLite 3.7.15)
- SQLITE_VERSION_NUMBER should be now always greater than 3006011
  (3.6.11).
2026-02-11 13:13:18 +01:00
Arnaud Le Blanc 65b4073922 Include the actual stub name in generated arginfo headers (#20993) 2026-01-21 20:57:00 +01:00
Tim Düsterhus 0fcd0bec11 Merge branch 'PHP-8.5'
* PHP-8.5:
  pdo: Fix scope for PDO mixins in pdo_hash_methods() (#20200)
2025-10-19 14:14:02 +02:00
Tim Düsterhus 1cb166cbbb pdo: Fix scope for PDO mixins in pdo_hash_methods() (#20200)
From what I see the incorrect scope is not observable in any other way. The
mixin methods are completely invisible to Reflection and a SQLite function
referring to a private method is still properly called as before.

Fixes php/php-src#20095.
2025-10-19 14:13:54 +02:00
Niels Dossche b272021d0c [ci skip] Remove outdated comment (#20125)
Yes this is correct, the blob is returned as a string so it needs to be
put that way into the return value.
2025-10-11 18:05:57 +02:00
Niels Dossche 57ce245e1e Reduce code bloat in arginfo by using specialised string releases (#20016)
* Reduce code bloat in arginfo by using specialised string releases

Comparing this patch to master (c7da728574),
with a plain configure command without any options:

```
   text	   data	    bss	    dec	    hex	filename
20683738	1592400	 137712	22413850	156021a	sapi/cli/php
20688522	1592400	 137712	22418634	15614ca	sapi/cli/php_old
```

We see a minor reduction of 0.023% in code size.

* Also use true for the other initialization line

* Also use specialized code for consts
2025-10-02 22:00:20 +02:00
Samuel Štancl a09d919ce8 Implement GH-8967: Add PDO_SQLITE_ATTR_TRANSACTION_MODE (#19317)
This commit implements GH-8967.

SQLite supports multiple transaction modes. These include:
- DEFERRED (default) only acquires a lock when you start a read/write
- IMMEDIATE acquires a reserved lock
- EXCLUSIVE acquires an exclusive lock (stricter than immediate)

In WAL mode IMMEDIATE and EXCLUSIVE are identical.

One reason for wanting to specify a transaction mode is that SQLite
doesn't respect busy_timeout when a DEFERRED transaction tries to
upgrade a read lock to a write lock. Normally if you try to acquire a
lock and have busy_timeout configured, SQLite will wait for that period
until giving up and erroring out (SQLITE_BUSY). With DEFERRED, if you
have a transaction that first reads and there's a concurrent writer
while it's trying to upgrade to a write lock, you will immediately get
SQLITE_BUSY regardless of your busy_timeout.

Prior to this commit, the only available workarounds were:
- Using $pdo->exec("BEGIN IMMEDIATE TRANSACTION") instead of
  $pdo->beginTransaction()
- Doing a dummy write at the start of each transaction so you don't get
  stuck with a read lock

Both of those aren't very usable, especially in a framework context
where the user doesn't have complete control over how transactions are
started.

To address that, this commit adds four class constants to Pdo\Sqlite:
- ATTR_TRANSACTION_MODE -- a new attribute
- TRANSACTION_MODE_DEFERRED = 0
- TRANSACTION_MODE_IMMEDIATE = 1
- TRANSACTION_MODE_EXCLUSIVE = 2

These can be used as:
  $pdo->setAttribute(
    $pdo::ATTR_TRANSACTION_MODE,
    $pdo::TRANSACTION_MODE_IMMEDIATE
  );
2025-09-07 15:42:30 +02:00
Arnaud Le Blanc a4afc57f1d Deprecate driver specific PDO methods
RFC: https://wiki.php.net/rfc/deprecations_php_8_5.

Closes GH-19596
2025-09-03 08:42:33 +02:00
Arnaud Le Blanc 6f32e1c690 Deprecate driver specific PDO constants
RFC: https://wiki.php.net/rfc/deprecations_php_8_5.

Closes GH-19526
2025-08-26 09:06:19 +02:00
Tim Düsterhus 732069d98b pdo: Deprecate the uri: DSN scheme (#19274)
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_pdo_s_urischeme
2025-08-08 21:24:15 +01:00
DanielEScherzer ddd33fd7e4 Generated arginfo headers: combine preprocessor conditional blocks (2) (#18667)
When global constants' or class constants' availability is based on some
preprocessor condition, the generated arginfo header files wrap the
declarations in the preprocessor `#if` conditional blocks, one per declaration,
even if they are in the same conditional block based on comments in the stub
file. Instead of having multiple conditional blocks one after the other with
the same condition, combine them into a single conditional block.
2025-06-22 14:35:28 -07:00
David CARLIER f129586459 ext/pdo_sqlite: fix minimal version for EXPLAIN feature support. (#18854) 2025-06-18 21:06:03 +01:00
Ilija Tovilo 2e2494fbef [skip ci] Fix whitespace in ext/pdo_sqlite/sqlite_statement.c 2025-06-14 16:00:13 +02:00
Ilija Tovilo 0a9697f5e1 Fix unused variable in pdo_sqlite_stmt_set_attribute() (GH-18851)
The indentation is also wrong (using spaces instead of tabs), but this should be
fixed in a separate commit.
2025-06-14 15:51:18 +02:00
David CARLIER 7361a1206d ext/pdo_sqlite: explain statement prefixing with its class for errors. (#18846) 2025-06-13 19:19:13 +01:00
David Carlier 71a254489c ext/pdo_sqlite: EXPLAIN mode support for SQL statements.
available since 3.41.0 we can reprepare a statement in either
 explain, explain query plan or the usual prepared mode.

close GH-18829
2025-06-13 05:45:45 +01:00
David Carlier 53231a81dd ext/pdo_sqlite: adding Pdo_Sqlite::ATTR_BUSY_STATEMENT
allow to check if a statement is still running before reusage.

close GH-18804
2025-06-09 18:24:35 +01:00
David Carlier e3cfa4bcae ext/pdo_sqlite: PDO::sqliteCreateCollection return type strenghtening.
Is supposed to be Pdo_Sqlite::createCollation but behavior differs in
regard of return type checks.

close GH-18799
2025-06-08 13:29:26 +01:00
David CARLIER ceffa70b97 ext/pdo_sqlite: Fix GH-18796 test exception message. (#18798) 2025-06-07 15:53:46 +01:00
David Carlier b72dccb3e3 Merge branch 'PHP-8.4' 2025-06-07 14:29:13 +01:00
David Carlier 1044558b64 ext/pdo_sqlite: createCollation memory leaks fix.
coming from callback arguments when its return type is incorrect.

close GH-18796
2025-06-07 14:28:29 +01:00