fix #34810 (mysqli::init() and others use wrong $this pointer without checks)

diff --git a/ext/mysqli/mysqli_api.c b/ext/mysqli/mysqli_api.c
index 66e4561c7bb319bea859d405bd0a222178c3a405..453fb023c4333a1ccbc7da7bb47a57a39af4a03b 100644 (file)
--- a/ext/mysqli/mysqli_api.c
+++ b/ext/mysqli/mysqli_api.c
@@ -1033,7 +1033,7 @@ PHP_FUNCTION(mysqli_init)
        mysqli_resource = (MYSQLI_RESOURCE *)ecalloc (1, sizeof(MYSQLI_RESOURCE));
        mysqli_resource->ptr = (void *)mysql;
 
-       if (!getThis()) {
+       if (!getThis() || !instanceof_function(Z_OBJCE_P(getThis()), mysqli_link_class_entry TSRMLS_CC)) {
                MYSQLI_RETURN_RESOURCE(mysqli_resource, mysqli_link_class_entry);       
        } else {
                ((mysqli_object *) zend_object_store_get_object(getThis() TSRMLS_CC))->ptr = mysqli_resource;

diff --git a/ext/mysqli/mysqli_nonapi.c b/ext/mysqli/mysqli_nonapi.c
index c5ff87f33db3f60f5fa1635e28323ef2c00cdde5..bef10913a7a8bc8c1d1d38ef791b1f0700fa5611 100644 (file)
--- a/ext/mysqli/mysqli_nonapi.c
+++ b/ext/mysqli/mysqli_nonapi.c
@@ -112,7 +112,7 @@ PHP_FUNCTION(mysqli_connect)
        mysqli_resource = (MYSQLI_RESOURCE *)ecalloc (1, sizeof(MYSQLI_RESOURCE));
        mysqli_resource->ptr = (void *)mysql;
 
-       if (!object) {
+       if (!object || !instanceof_function(Z_OBJCE_P(object), mysqli_link_class_entry TSRMLS_CC)) {
                MYSQLI_RETURN_RESOURCE(mysqli_resource, mysqli_link_class_entry);       
        } else {
                ((mysqli_object *) zend_object_store_get_object(object TSRMLS_CC))->ptr = mysqli_resource;

diff --git a/ext/mysqli/mysqli_warning.c b/ext/mysqli/mysqli_warning.c
index 3029d827cff78812c8c8c87d30ebf091086d1358..3ea578f6c78d81d4645b8ab31a28780de40d8701 100644 (file)
--- a/ext/mysqli/mysqli_warning.c
+++ b/ext/mysqli/mysqli_warning.c
@@ -201,8 +201,8 @@ PHP_METHOD(mysqli_warning, __construct)
        mysqli_resource = (MYSQLI_RESOURCE *)ecalloc (1, sizeof(MYSQLI_RESOURCE));
        mysqli_resource->ptr = mysqli_resource->info = (void *)w;
 
-       if (!getThis()) {
-               MYSQLI_RETURN_RESOURCE(mysqli_resource, mysqli_link_class_entry);       
+       if (!getThis() || !instanceof_function(Z_OBJCE_P(getThis()), mysqli_warning_class_entry TSRMLS_CC)) {
+               MYSQLI_RETURN_RESOURCE(mysqli_resource, mysqli_warning_class_entry);    
        } else {
                ((mysqli_object *) zend_object_store_get_object(getThis() TSRMLS_CC))->ptr = mysqli_resource;
                ((mysqli_object *) zend_object_store_get_object(getThis() TSRMLS_CC))->valid = 1;

diff --git a/ext/mysqli/php_mysqli.h b/ext/mysqli/php_mysqli.h
index 4298ebf851d0264d3173e74823968b1aebad1c72..5999d12551dbc9292616f88cdb8f35dd75d7717a 100644 (file)
--- a/ext/mysqli/php_mysqli.h
+++ b/ext/mysqli/php_mysqli.h
@@ -191,7 +191,7 @@ PHP_MYSQLI_EXPORT(zend_object_value) mysqli_objects_new(zend_class_entry * TSRML
 #define MYSQLI_REGISTER_RESOURCE(__ptr, __ce) \
 {\
        zval *object = getThis();\
-       if (!object) {\
+       if (!object || !instanceof_function(Z_OBJCE_P(object), mysqli_link_class_entry TSRMLS_CC)) {\
                object = return_value;\
                Z_TYPE_P(object) = IS_OBJECT;\
                (object)->value.obj = mysqli_objects_new(__ce TSRMLS_CC);\

diff --git a/ext/mysqli/tests/bug34810.phpt b/ext/mysqli/tests/bug34810.phpt
new file mode 100644 (file)
index 0000000..12d6ce2
--- /dev/null
+++ b/ext/mysqli/tests/bug34810.phpt
@@ -0,0 +1,38 @@
+--TEST--
+bug #34810 (mysqli::init() and others use wrong $this pointer without checks)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+class DbConnection { 
+       public function connect() {
+               include "connect.inc";
+
+               $link = mysqli::connect($host, $user, $passwd);
+               var_dump($link); 
+               
+               $link = mysqli::init();
+               var_dump($link);
+               
+               $mysql = new mysqli($host, $user, $passwd, "test");
+               $mysql->query("DROP TABLE IF EXISTS test_warnings");
+               $mysql->query("CREATE TABLE test_warnings (a int not null)");
+               $mysql->query("INSERT INTO test_warnings VALUES (1),(2),(NULL)");
+               var_dump(mysqli_warning::__construct($mysql));
+       } 
+} 
+
+$db = new DbConnection(); 
+$db->connect();
+
+echo "Done\n";
+?>
+--EXPECTF--    
+object(mysqli)#%d (0) {
+}
+object(mysqli)#%d (0) {
+}
+object(mysqli_warning)#%d (0) {
+}
+Done