ext/pdo: Report bound params/columns to GC and fix driver_params refcount

NEWS

@@ -57,6 +57,11 @@ PHP                                                                        NEWS
     is_cacheable_stream_path()). (ndossche)
 
 - PDO:
+  . Fixed a leaked reference to the driver options passed to
+    PDOStatement::bindParam() and PDOStatement::bindColumn().
+    (Ilia Alshanetsky)
+  . Fixed PDOStatement not reporting its bound parameters and columns to the
+    cycle collector. (Ilia Alshanetsky)
   . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
     column index. (Ilia Alshanetsky)
   . Fixed PDOStatement::bindColumn() registering a binding for a column name

ext/pdo/pdo_stmt.c

@@ -287,10 +287,6 @@ static bool really_register_bound_param(struct pdo_bound_param_data *param, pdo_
 	param->stmt = stmt;
 	param->is_param = is_param;
 
-	if (Z_REFCOUNTED(param->driver_params)) {
-		Z_ADDREF(param->driver_params);
-	}
-
 	if (!is_param && param->name && stmt->columns) {
 		/* try to map the name to the column */
 		int i;
@@ -376,6 +372,7 @@ static bool really_register_bound_param(struct pdo_bound_param_data *param, pdo_
 			}
 			/* param->parameter is freed by hash dtor */
 			ZVAL_UNDEF(&param->parameter);
+			ZVAL_UNDEF(&param->driver_params);
 			return 0;
 		}
 	}
@@ -1462,6 +1459,9 @@ static void register_bound_param(INTERNAL_FUNCTION_PARAMETERS, int is_param) /*
 		if (!Z_ISUNDEF(param.parameter)) {
 			zval_ptr_dtor(&(param.parameter));
 		}
+		if (!Z_ISUNDEF(param.driver_params)) {
+			zval_ptr_dtor(&(param.driver_params));
+		}
 
 		RETURN_FALSE;
 	}
@@ -2108,6 +2108,22 @@ static HashTable *dbstmt_get_gc(zend_object *object, zval **gc_data, int *gc_cou
 	zend_get_gc_buffer *gc_buffer = zend_get_gc_buffer_create();
 	zend_get_gc_buffer_add_zval(gc_buffer, &stmt->database_object_handle);
 	zend_get_gc_buffer_add_zval(gc_buffer, &stmt->fetch.into);
+	if (stmt->bound_params) {
+		zval *val;
+		ZEND_HASH_FOREACH_VAL(stmt->bound_params, val) {
+			struct pdo_bound_param_data *param = Z_PTR_P(val);
+			zend_get_gc_buffer_add_zval(gc_buffer, &param->parameter);
+			zend_get_gc_buffer_add_zval(gc_buffer, &param->driver_params);
+		} ZEND_HASH_FOREACH_END();
+	}
+	if (stmt->bound_columns) {
+		zval *val;
+		ZEND_HASH_FOREACH_VAL(stmt->bound_columns, val) {
+			struct pdo_bound_param_data *param = Z_PTR_P(val);
+			zend_get_gc_buffer_add_zval(gc_buffer, &param->parameter);
+			zend_get_gc_buffer_add_zval(gc_buffer, &param->driver_params);
+		} ZEND_HASH_FOREACH_END();
+	}
 	zend_get_gc_buffer_use(gc_buffer, gc_data, gc_count);
 
 	/**

ext/pdo/tests/get_gc_bound_params.phpt

@@ -0,0 +1,42 @@
+--TEST--
+PDOStatement::get_gc() must report bound params and columns for cycle collection
+--EXTENSIONS--
+pdo
+pdo_sqlite
+--FILE--
+<?php
+class Tracked {
+    public $stmt;
+    function __destruct() {
+        echo "collected\n";
+    }
+}
+$db = new PDO('sqlite::memory:');
+$db->exec('CREATE TABLE test(a INT)');
+$stmt = $db->prepare('INSERT INTO test VALUES (?)');
+$stmt->execute([1]);
+$stmt2 = $db->prepare('SELECT a FROM test');
+$stmt2->execute();
+$stmt2->fetch(PDO::FETCH_ASSOC);
+for ($i = 0; $i < 3; $i++) {
+    $val = 1;
+    $tracked = new Tracked();
+    $tracked->stmt = $stmt;
+    $stmt->bindParam(1, $val, PDO::PARAM_INT, 0, $tracked);
+    $col = null;
+    $tracked2 = new Tracked();
+    $tracked2->stmt = $stmt2;
+    $stmt2->bindColumn('a', $col, PDO::PARAM_STR, 0, $tracked2);
+    unset($tracked, $tracked2);
+}
+unset($stmt, $stmt2, $db);
+gc_collect_cycles();
+echo "end\n";
+--EXPECT--
+collected
+collected
+collected
+collected
+collected
+collected
+end