ext/pdo: Do not register a bindColumn() binding after an exception

Under ERRMODE_EXCEPTION, really_register_bound_param() raised the
implementation error for an unknown column name and then registered the
binding anyway, so repeated failing bindColumn() calls with distinct names
grew bound_columns without bound. Abort registration once an exception is
pending; bindValue() and bindParam() take the is_param path and are
unaffected.

Author: iliaal

NEWS

@@ -43,6 +43,8 @@ PHP                                                                        NEWS
 - PDO:
   . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
     column index. (Ilia Alshanetsky)
+  . Fixed bindColumn() registering a binding for an unknown column name after
+    an exception was thrown. (Ilia Alshanetsky)
 
 - Readline:
   . Fixed a heap over-read in the interactive shell prompt when cli.prompt is

ext/pdo/pdo_stmt.c

@@ -311,6 +311,9 @@ static bool really_register_bound_param(struct pdo_bound_param_data *param, pdo_
 			spprintf(&tmp, 0, "Did not find column name '%s' in the defined columns; it will not be bound", ZSTR_VAL(param->name));
 			pdo_raise_impl_error(stmt->dbh, stmt, "HY000", tmp);
 			efree(tmp);
+			if (EG(exception)) {
+				return 0;
+			}
 		}
 	}
 

ext/pdo/tests/bug_bindcolumn_exception_leak.phpt

@@ -0,0 +1,35 @@
+--TEST--
+PDO: bindColumn() must not register the binding when an exception is thrown for an unknown column name
+--EXTENSIONS--
+pdo
+pdo_sqlite
+--FILE--
+<?php
+$db = new PDO('sqlite::memory:');
+$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+$stmt = $db->prepare('SELECT 1 AS foo');
+$stmt->execute();
+$var = null;
+$n = 200000;
+for ($i = 0; $i < $n; $i++) {
+    try {
+        $stmt->bindColumn("bogus$i", $var);
+    } catch (PDOException $e) {
+    }
+}
+$before = memory_get_usage();
+for ($i = 0; $i < $n; $i++) {
+    try {
+        $stmt->bindColumn("bogus$i", $var);
+    } catch (PDOException $e) {
+    }
+}
+$diff = memory_get_usage() - $before;
+if ($diff > 1000) {
+    echo "LEAK\n";
+} else {
+    echo "OK\n";
+}
+?>
+--EXPECT--
+OK