Conversation
…xecuted SQLite3Stmt::close() and SQLite3Result::finalize() reach sqlite3_finalize() through the database free list, and SQLite3Stmt::reset(), SQLite3Result:: reset() and a sibling result's destructor reach sqlite3_reset(). Called from a userland function, aggregate or collation callback, either destroys the statement sqlite3_step() is executing, so the step returns into freed memory or the next one walks a reset VDBE. Track per statement whether it is being stepped, throw from the four methods while it is, and skip the reset in the result destructor, which cannot throw. phpGH-23650 added a per-database in_callback counter for SQLite3::close(), which destroys every statement on the connection, but that counter is too coarse here: finalizing an unrelated statement while another one steps is safe and keeps working. SQLite3Stmt::clear() is left alone, sqlite3_clear_bindings() mid-step is tolerated. Fixes phpGH-23728
iliaal
force-pushed
the
fix/gh-23728-stmt-close-during-step
branch
from
September 17, 2026 17:50
1a871a8 to
dedba2b
Compare
Owner
Author
|
Submitted upstream as php#23736. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SQLite3Stmt::close() and SQLite3Result::finalize() reach sqlite3_finalize() through the database free list, and SQLite3Stmt::reset(), SQLite3Result::reset() and a sibling result's destructor reach sqlite3_reset(). From a userland function, aggregate or collation callback, either destroys the statement sqlite3_step() is executing. Tracking per statement whether it is being stepped, throwing from the four methods and skipping the reset in the destructor, leaves the statement usable once the query finishes. The per-database in_callback counter phpGH-23650 added for SQLite3::close() is too coarse here, since finalizing an unrelated statement while another one steps is safe and keeps working, and sqlite3_stmt_busy() would reject a close after a partial fetch outside any callback.
Fixes php#23728