This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

Thanks.

With patch committed to SVN (r301916), segmentation fault still occurs.

The issue is the val->data pointer is null at the time of spprintf() being called.  Using "8" in place of "val->len" or sizeof(DBFLT8) in the dbconvert() call does not help at all.

Patch uploaded as diff of actual SVN checkout this time.

Patch made from PHP_5_2 branch, but appears to be the same for PHP_5_3

Here's a fix.

Test code
---------
<?php
$dbh = new PDO('dblib:dbname=DB;host=HOST', 'USER', 'PASS');
$sth = $dbh->query  ('create table #tmp(col money)');
$sth = $dbh->query  ('insert into #tmp(col) values(123.25)');
$sth = $dbh->query  ('insert into #tmp(col) values(-123.25)');
$sth = $dbh->prepare('SELECT col FROM #tmp');
$sth->execute();
$r = $sth->fetchAll(2);
print_r($r);
---------

Output
---------
Array
(
    [0] => Array
        (
            [col] => 123.2500
        )

    [1] => Array
        (
            [col] => -123.2500
        )

)
---------

Diff
---------
--- php-5.3.3/ext/pdo_dblib/dblib_stmt.c        2010-03-08 13:39:44.000000000 +0100
+++ ../php-5.3.3/ext/pdo_dblib/dblib_stmt.c     2010-08-10 15:18:48.000000000 +0200
@@ -170,8 +170,10 @@
                                        case SQLMONEY4:
                                        case SQLMONEYN: {
                                                DBFLT8 money_value;
+                                               val->len = (2 * dbdatlen(H->link, i + 1)) + 32;
+                                               val->data = emalloc(val->len);
                                                dbconvert(NULL, S->cols[i].coltype, dbdata(H->link, i+1), dbdatlen(H->link, i+1), SQLFLT8, (LPBYTE)&money_value, val->len);
-                                               val->len = spprintf(val->data, 0, "%.4f", money_value);
+                                               val->len = sprintf(val->data, "%.4f", money_value);
                                                }
                                                break;
                                        default:
---------

Reopening, given it's apparently still segfaulting. Felipe, can you cast an eye over the new patch, please?

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

rgagnon24 and preben: the spprintf() function already allocates the memory, this is not the problem... The problem is that the function expect char** and I was passing char*. It must be fixed now.

Thanks for the testing.

Just to inform, the fix for this bug was committed just for 5.3 branch. The trunk branch has a bit different code, due some others bugs fixes trunk-only. And 5.2 branch is just accepting security bug fixes.

As an FYI.  I've been able to confirm the r302196 commit does resolve the issue in 5.3.

I know 5.2 is closed for fixes, but to leave a note for anyone that wishes to manually patch their copy, this does fix it for the released 5.2.14 as well.

The only change I would suggest is maybe using sizeof(DBFLT8) in place of the hard-coded "8" integer in the call to dbconvert()

Ilia's approved this for 5.2 as well. I'll merge the fix in later tonight, hopefully.

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.