Fixed bug #63398 (Segfault when polling closed link)

diff --git a/NEWS b/NEWS
index 53f011202881a6e8a6ebfba8ff94d1ed620d082b..68a88ed08c4205bde0a6b542ff0201ba79f8790b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,9 @@ PHP                                                                        NEWS
 - Imap:
   . Fixed Bug #63126 DISABLE_AUTHENTICATOR ignores array (Remi)
 
+- MySQLnd:
+  . Fixed bug #63398 (Segfault when polling closed link). (Laruence)
+
 - Reflection:
   . Fixed Bug #63614 (Fatal error on Reflection). (Laruence)
 

diff --git a/ext/mysqli/mysqli_nonapi.c b/ext/mysqli/mysqli_nonapi.c
index 0ef67a2c44adbe5ce1915e1c1e388b0b85c35da5..a6cbcf17484f9db87379f5e84927e25ec380f211 100644 (file)
--- a/ext/mysqli/mysqli_nonapi.c
+++ b/ext/mysqli/mysqli_nonapi.c
@@ -607,7 +607,7 @@ static int mysqlnd_zval_array_from_mysqlnd_array(MYSQLND **in_array, zval *out_a
        MYSQLND **p = in_array;
        HashTable *new_hash;
        zval **elem, **dest_elem;
-       int ret = 0;
+       int ret = 0, i = 0;
 
        ALLOC_HASHTABLE(new_hash);
        zend_hash_init(new_hash, zend_hash_num_elements(Z_ARRVAL_P(out_array)), NULL, ZVAL_PTR_DTOR, 0);
@@ -616,13 +616,19 @@ static int mysqlnd_zval_array_from_mysqlnd_array(MYSQLND **in_array, zval *out_a
                 zend_hash_get_current_data(Z_ARRVAL_P(out_array), (void **) &elem) == SUCCESS;
                 zend_hash_move_forward(Z_ARRVAL_P(out_array)))
        {
+               i++;
                if (Z_TYPE_PP(elem) != IS_OBJECT || !instanceof_function(Z_OBJCE_PP(elem), mysqli_link_class_entry TSRMLS_CC)) {
                        continue;
                }
                {
                        MY_MYSQL *mysql;
+                       MYSQLI_RESOURCE *my_res;
                        mysqli_object *intern = (mysqli_object *)zend_object_store_get_object(*elem TSRMLS_CC);
-                       mysql = (MY_MYSQL *) ((MYSQLI_RESOURCE *)intern->ptr)->ptr;
+                       if (!(my_res = (MYSQLI_RESOURCE *)intern->ptr)) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "[%d] Couldn't fetch %s", i, intern->zo.ce->name);
+                               continue;
+                       }
+                       mysql = (MY_MYSQL *) my_res->ptr;
                        if (mysql->mysql == *p) {
                                zend_hash_next_index_insert(new_hash, (void *)elem, sizeof(zval *), (void **)&dest_elem);
                                if (dest_elem) {

diff --git a/ext/mysqli/tests/bug63398.phpt b/ext/mysqli/tests/bug63398.phpt
new file mode 100644 (file)
index 0000000..6dffa8c
--- /dev/null
+++ b/ext/mysqli/tests/bug63398.phpt
@@ -0,0 +1,34 @@
+--TEST--\r
+Bug #63398 (Segfault when polling closed link)\r
+--SKIPIF--\r
+<?php\r
+require_once('skipif.inc');\r
+require_once("connect.inc");\r
+if (!$IS_MYSQLND) {\r
+    die("skip mysqlnd only test");\r
+}\r
+?>\r
+--FILE--\r
+<?php\r
+$link = new mysqli('localhost', 'test', NULL, 'test');\r
+\r
+mysqli_close($link);\r
+\r
+$read = $error = $reject = array();\r
+$read[] = $error[] = $reject[] = $link;\r
+\r
+mysqli_poll($read, $error, $reject, 1);\r
+\r
+echo "okey";\r
+?>\r
+--EXPECTF--\r
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d\r
+\r
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d\r
+\r
+Warning: mysqli_poll(): No stream arrays were passed in %sbug63398.php on line %d\r
+\r
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d\r
+\r
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d\r
+okey\r