thekid/rfc — Issue #23: RFC 0023: Fix memory corruption in rdbms.Criteria
Author: thekid
Created: 2011-10-09 14:15:37+00:00
State: open

Scope of Change
====
The constructor of rdbms.Criteria will be removed, and a new static
method createFor() will be added which basically mimics the constructor's
behaviour and retrieves an arbitrary list of conditions.

Note: this is a BC-break!

Rationale
====
The constructor calls func_get_args() to get the list of arguments it has
been invoked with. func_get_args() is known to cause memory corruption which
usually does not lead to problems with short running applications (such
as web frontends) but can cause heavy damage to long running applications.

By removing the constructor, there won't be any calls to func_get_args left
- Object::Object() does not call the function either, because __construct()
does not exist any more.

Functionality
====
As a replacement for the old functionality of the constructor, a new method
createFor() will be added which must be invoked statically.

The old way of creating criteria objects changes from:

```php

```

to

```php

```

The "safe" way that prevents memory corruption then is

```php
add('bz_id', $bz_id, EQUAL);
?>
```

Security considerations
====
The new implementation is supposed to prevent severe memory corruption
in long running applications and thus is considered more secure.

Speed impact
====
n/a

Dependencies
====
- ports/dist/database/util/classgen/data/xp.php.xsl must be updated to
generate database classes following the new Criteria implementation.

Related documents
====
- http://xp-framework.net/downloads/rfc0023.diff
Patch against / implementing this change

Comments
====