- MFH: Improved fix

2 files changed, 41 insertions, 4 deletions

diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 841a362f64..058d876776 100755
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -2615,10 +2615,8 @@ static zval *row_prop_or_dim_read(zval *object, zval *member, int type TSRMLS_DC
 	pdo_stmt_t * stmt = (pdo_stmt_t *) zend_object_store_get_object(object TSRMLS_CC);
 	int colno = -1;
 
-	if (Z_TYPE_P(member) == IS_STRING && strcmp(Z_STRVAL_P(member), "queryString") == 0) {
-		return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
-	}
 	MAKE_STD_ZVAL(return_value);
+	RETVAL_NULL();
 		
 	if (Z_TYPE_P(member) == IS_LONG) {
 		if (Z_LVAL_P(member) >= 0 && Z_LVAL_P(member) < stmt->column_count) {
@@ -2631,9 +2629,15 @@ static zval *row_prop_or_dim_read(zval *object, zval *member, int type TSRMLS_DC
 		for (colno = 0; colno < stmt->column_count; colno++) {
 			if (strcmp(stmt->columns[colno].name, Z_STRVAL_P(member)) == 0) {
 				fetch_value(stmt, return_value, colno, NULL TSRMLS_CC);
-				break;
+				Z_SET_REFCOUNT_P(return_value, 0);
+				Z_UNSET_ISREF_P(return_value);
+				return return_value;
 			}
 		}
+		if (strcmp(Z_STRVAL_P(member), "queryString") == 0) {
+			zval_ptr_dtor(&return_value);
+			return std_object_handlers.read_property(object, member, IS_STRING TSRMLS_CC);
+		}
 	}
 
 	Z_SET_REFCOUNT_P(return_value, 0);
diff --git a/ext/pdo_sqlite/tests/bug44327_3.phpt b/ext/pdo_sqlite/tests/bug44327_3.phpt
new file mode 100644
index 0000000000..4d704c3d65
--- /dev/null
+++ b/ext/pdo_sqlite/tests/bug44327_3.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #44327.3 (PDORow::queryString property & numeric offsets / Crash)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_sqlite')) print 'skip not loaded';
+?>
+--FILE--
+<?php
+
+$db = new pdo('sqlite:memory');
+
+$x = $db->query('select 1 as queryStringxx');
+$y = $x->fetch(PDO::FETCH_LAZY);
+var_dump($y, $y->queryString, $y->queryStringzz, $y->queryStringxx);
+
+print "---\n";
+
+var_dump($y[5], $y->{3});
+
+?>
+--EXPECTF--
+object(PDORow)#%d (2) {
+  ["queryString"]=>
+  string(25) "select 1 as queryStringxx"
+  ["queryStringxx"]=>
+  string(1) "1"
+}
+string(25) "select 1 as queryStringxx"
+NULL
+string(1) "1"
+---
+NULL
+NULL