Skip to content

ext/pdo: Do not register a bindColumn() binding after an exception - #23799

Open
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/pdo-bindcolumn-leak-84
Open

iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/pdo-bindcolumn-leak-84

Conversation

@iliaal

@iliaal iliaal commented Sep 20, 2026

Copy link
Copy Markdown
Member

Under ERRMODE_EXCEPTION, really_register_bound_param() raises the implementation error for an unknown column name and then registers the binding anyway, so repeated failing bindColumn() calls with distinct names grow bound_columns without bound, about 33 MB over 200k calls. Registration now aborts once an exception is pending. bindValue() and bindParam() take the is_param path, which skips this mapping block, so they are unaffected.

Under ERRMODE_EXCEPTION, really_register_bound_param() raised the
implementation error for an unknown column name and then registered the
binding anyway, so repeated failing bindColumn() calls with distinct names
grew bound_columns without bound. Abort registration once an exception is
pending; bindValue() and bindParam() take the is_param path and are
unaffected.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant