Fixed REFERENCE handling

1 files changed, 18 insertions, 6 deletions

diff --git a/ext/pdo/pdo_sql_parser.c b/ext/pdo/pdo_sql_parser.c
index 50b2b5d6ec..cf108991e5 100644
--- a/ext/pdo/pdo_sql_parser.c
+++ b/ext/pdo/pdo_sql_parser.c
@@ -527,7 +527,7 @@ PDO_API int pdo_parse_params(pdo_stmt_t *stmt, char *inquery, int inquery_len,
 		if (query_type != PDO_PLACEHOLDER_POSITIONAL && bindno > zend_hash_num_elements(params)) {
 			int ok = 1;
 			for (plc = placeholders; plc; plc = plc->next) {
-				if ((params = zend_hash_str_find_ptr(params, plc->pos, plc->len)) == NULL) {
+				if ((param = zend_hash_str_find_ptr(params, plc->pos, plc->len)) == NULL) {
 					ok = 0;
 					break;
 				}
@@ -561,10 +561,16 @@ safe:
 				goto clean_up;
 			}
 			if (stmt->dbh->methods->quoter) {
-				if (param->param_type == PDO_PARAM_LOB && Z_TYPE(param->parameter) == IS_RESOURCE) {
+				zval *parameter;
+				if (Z_ISREF(param->parameter)) {
+					parameter = Z_REFVAL(param->parameter);
+				} else {
+					parameter = &param->parameter;
+				}
+				if (param->param_type == PDO_PARAM_LOB && Z_TYPE_P(parameter) == IS_RESOURCE) {
 					php_stream *stm;
 
-					php_stream_from_zval_no_verify(stm, &param->parameter);
+					php_stream_from_zval_no_verify(stm, parameter);
 					if (stm) {
 						zend_string *buf;
 					
@@ -590,7 +596,7 @@ safe:
 					plc->freeq = 1;
 				} else {
 					zval tmp_param;
-				   	ZVAL_DUP(&tmp_param, &param->parameter);
+				   	ZVAL_DUP(&tmp_param, parameter);
 					switch (Z_TYPE(tmp_param)) {
 						case IS_NULL:
 							plc->quoted = "NULL";
@@ -625,8 +631,14 @@ safe:
 					zval_dtor(&tmp_param);
 				}
 			} else {
-				plc->quoted = Z_STRVAL(param->parameter);
-				plc->qlen = Z_STRLEN(param->parameter);
+				zval *parameter;
+				if (Z_ISREF(param->parameter)) {
+					parameter = Z_REFVAL(param->parameter);
+				} else {
+					parameter = &param->parameter;
+				}
+				plc->quoted = Z_STRVAL_P(parameter);
+				plc->qlen = Z_STRLEN_P(parameter);
 			}
 			newbuffer_len += plc->qlen;
 		}