fix #36420 (segfault when access result->num_rows after calling result->close())

diff --git a/ext/mysqli/mysqli_prop.c b/ext/mysqli/mysqli_prop.c
index 3318944cc725e5f9a28d77a7c26e84bd804101a4..19db5bc1de2270e5d5451fab392165b60c3774de 100644 (file)
--- a/ext/mysqli/mysqli_prop.c
+++ b/ext/mysqli/mysqli_prop.c
@@ -40,13 +40,34 @@
 MYSQL *p; \
 ALLOC_ZVAL(*retval);\
 CHECK_OBJECT();\
-p = (MYSQL *)((MY_MYSQL *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr)->mysql;
+if (!obj->ptr || !(MY_MYSQL *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr) { \
+       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Couldn't fetch %s", obj->zo.ce->name);\
+       ZVAL_NULL(*retval);\
+       return SUCCESS; \
+} else if (!obj->valid) { \
+       php_error_docref(NULL TSRMLS_CC, E_WARNING, "invalid resource %s", obj->zo.ce->name);\
+       ZVAL_NULL(*retval);\
+       return SUCCESS; \
+} else { \
+       p = (MYSQL *)((MY_MYSQL *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr)->mysql; \
+}
 
 #define MYSQLI_GET_RESULT() \
 MYSQL_RES *p; \
 ALLOC_ZVAL(*retval);\
 CHECK_OBJECT();\
-p = (MYSQL_RES *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr
+if (!obj->ptr) { \
+       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Couldn't fetch %s", obj->zo.ce->name);\
+       ZVAL_NULL(*retval);\
+       return SUCCESS; \
+} else if (!obj->valid) { \
+       php_error_docref(NULL TSRMLS_CC, E_WARNING, "invalid resource %s", obj->zo.ce->name);\
+       ZVAL_NULL(*retval);\
+       return SUCCESS; \
+} else { \
+       p = (MYSQL_RES *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr; \
+}
+
 
 #define MYSQLI_GET_STMT() \
 MYSQL_STMT *p; \

diff --git a/ext/mysqli/tests/bug36420.phpt b/ext/mysqli/tests/bug36420.phpt
new file mode 100644 (file)
index 0000000..d35485e
--- /dev/null
+++ b/ext/mysqli/tests/bug36420.phpt
@@ -0,0 +1,25 @@
+--TEST--
+bug #36420 (segfault when access result->num_rows after calling result->close())
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+include "connect.inc";
+$mysqli = mysqli_connect($host, $user, $passwd);
+
+$result = $mysqli->query('select 1');
+
+$result->close();
+echo $result->num_rows;
+
+$mysqli->close();
+echo $result->num_rows;
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Warning: main(): Couldn't fetch mysqli_result in %s on line %d
+
+Warning: main(): Couldn't fetch mysqli_result in %s on line %d
+Done