- Fixed PDORow and PDOStatement crashes when instantiating throught Reflection

Zend/zend_objects.c

@@ -49,7 +49,7 @@ ZEND_API void zend_object_std_dtor(zend_object *object TSRMLS_DC)
 
 ZEND_API void zend_objects_destroy_object(zend_object *object, zend_object_handle handle TSRMLS_DC)
 {
-	zend_function *destructor = object->ce->destructor;
+	zend_function *destructor = object ? object->ce->destructor : NULL;
 
 	if (destructor) {
 		zval *obj;

ext/pdo/pdo_dbh.c

@@ -110,7 +110,7 @@ void pdo_handle_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt TSRMLS_DC) /* {{{ */
 	char *message = NULL;
 	zval *info = NULL;
 
-	if (dbh->error_mode == PDO_ERRMODE_SILENT) {
+	if (dbh == NULL || dbh->error_mode == PDO_ERRMODE_SILENT) {
 		return;
 	}
 	

ext/pdo/pdo_stmt.c

@@ -2663,26 +2663,28 @@ static zval *row_prop_or_dim_read(zval *object, zval *member, int type TSRMLS_DC
 
 	MAKE_STD_ZVAL(return_value);
 	RETVAL_NULL();
-		
-	if (Z_TYPE_P(member) == IS_LONG) {
-		if (Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count) {
-			fetch_value(stmt, return_value, Z_LVAL_P(member), NULL TSRMLS_CC);
-		}
-	} else {
-		convert_to_string(member);
-		/* TODO: replace this with a hash of available column names to column
-		 * numbers */
-		for (colno = 0; colno < stmt->column_count; colno++) {
-			if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
-				fetch_value(stmt, return_value, colno, NULL TSRMLS_CC);
-				Z_SET_REFCOUNT_P(return_value, 0);
-				Z_UNSET_ISREF_P(return_value);
-				return return_value;
+
+	if (stmt) {
+		if (Z_TYPE_P(member) == IS_LONG) {
+			if (Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count) {
+				fetch_value(stmt, return_value, Z_LVAL_P(member), NULL TSRMLS_CC);
+			}
+		} else {
+			convert_to_string(member);
+			/* TODO: replace this with a hash of available column names to column
+			 * numbers */
+			for (colno = 0; colno < stmt->column_count; colno++) {
+				if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
+					fetch_value(stmt, return_value, colno, NULL TSRMLS_CC);
+					Z_SET_REFCOUNT_P(return_value, 0);
+					Z_UNSET_ISREF_P(return_value);
+					return return_value;
+				}
+			}
+			if (strcmp(Z_STRVAL_P(member), "queryString") == 0) {
+				zval_ptr_dtor(&return_value);
+				return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
 			}
-		}
-		if (strcmp(Z_STRVAL_P(member), "queryString") == 0) {
-			zval_ptr_dtor(&return_value);
-			return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
 		}
 	}
 
@@ -2702,16 +2704,18 @@ static int row_prop_or_dim_exists(zval *object, zval *member, int check_empty TS
 	pdo_stmt_t * stmt = (pdo_stmt_t *) zend_object_store_get_object(object TSRMLS_CC);
 	int colno = -1;
 
-	if (Z_TYPE_P(member) == IS_LONG) {
-		return Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count;
-	} else {
-		convert_to_string(member);
+	if (stmt) {
+		if (Z_TYPE_P(member) == IS_LONG) {
+			return Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count;
+		} else {
+			convert_to_string(member);
 
-		/* TODO: replace this with a hash of available column names to column
-		 * numbers */
-		for (colno = 0; colno < stmt->column_count; colno++) {
-			if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
-				return 1;
+			/* TODO: replace this with a hash of available column names to column
+			 * numbers */
+			for (colno = 0; colno < stmt->column_count; colno++) {
+				if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
+					return 1;
+				}
 			}
 		}
 	}
@@ -2729,6 +2733,10 @@ static HashTable *row_get_properties(zval *object TSRMLS_DC)
 	pdo_stmt_t * stmt = (pdo_stmt_t *) zend_object_store_get_object(object TSRMLS_CC);
 	int i;
 
+	if (stmt == NULL) {
+		return NULL;
+	}
+	
 	for (i = 0; i < stmt->column_count; i++) {
 		zval *val;
 		MAKE_STD_ZVAL(val);

ext/pdo/tests/pdo_036.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Testing PDORow and PDOStatement instances with Reflection
+--FILE--
+<?php
+
+$instance = new reflectionclass('pdorow');
+$x = $instance->newInstance();
+var_dump($x);
+
+$instance = new reflectionclass('pdostatement');
+$x = $instance->newInstance();
+var_dump($x);
+
+?>
+--EXPECTF--
+object(PDORow)#%d (0) {
+}
+object(PDOStatement)#%d (1) {
+  [%u|b%"queryString"]=>
+  NULL
+}