Fix for bug#48909 Segmentation fault in mysqli_stmt_execute

diff --git a/ext/mysqli/mysqli_api.c b/ext/mysqli/mysqli_api.c
index 72301d3fa910a44b7a585bbbcabd2d4e385c0052..8b4d7a18277893cd5607bcf4bd0b3ec7ac858c94 100644 (file)
--- a/ext/mysqli/mysqli_api.c
+++ b/ext/mysqli/mysqli_api.c
@@ -741,7 +741,7 @@ PHP_FUNCTION(mysqli_stmt_execute)
                for (i = 0; i < stmt->param.var_cnt; i++) {
                        for (j = i + 1; j < stmt->param.var_cnt; j++) {
                                /* Oops, someone binding the same variable - clone */
-                               if (stmt->param.vars[j] == stmt->param.vars[i]) {
+                               if (stmt->param.vars[j] == stmt->param.vars[i] && stmt->param.vars[i]) {
                                        php_mysqli_stmt_copy_it(&copies, stmt->param.vars[i], stmt->param.var_cnt, i);
                                        break;
                                }

diff --git a/ext/mysqli/tests/bug48909.phpt b/ext/mysqli/tests/bug48909.phpt
new file mode 100644 (file)
index 0000000..d34e6cd
--- /dev/null
+++ b/ext/mysqli/tests/bug48909.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #48909 (Segmentation fault in mysqli_stmt_execute)
+--SKIPIF--
+<?php 
+require_once('skipif.inc'); 
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+       include "connect.inc";
+
+       include "table.inc";
+       
+       $stmt = $link->prepare("insert into test values (?,?)");
+       var_dump($stmt->bind_param("bb",$bvar,$bvar));
+       var_dump($stmt->execute());
+       $stmt->close();
+       $link->close();
+       echo "done";    
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+done