MFH: fix #33491 (crash after extending MySQLi internal class)

diff --git a/NEWS b/NEWS
index b5c1cab3e147b7f8018e6f19d81d9f9a2305ea0b..cb6877d96f7325e0a031358dec3e076a68c6aaf0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,7 @@ PHP                                                                        NEWS
 - Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey)
 - Fixed memory corruption in stristr(). (Derick)
 - Fixed segfaults when CURL callback functions throw exception. (Tony)
+- Fixed bug #33491 (crash after extending MySQLi internal class). (Tony)
 - Fixed bug #33340 (CLI Crash when calling php:function from XSLT). (Rob)
 - Fixed bug #33277 (private method accessed by child class). (Dmitry)
 - Fixed bug #33268 (iconv_strlen() works only with a parameter of < 3 in 

diff --git a/ext/mysqli/mysqli.c b/ext/mysqli/mysqli.c
index ac7ab3c554d5a6fd93c1f21ac7f0be0b9a4250a9..45116f81578c0d2412a890fd4cdf920ea7bd0bd7 100644 (file)
--- a/ext/mysqli/mysqli.c
+++ b/ext/mysqli/mysqli.c
@@ -118,19 +118,30 @@ void php_clear_mysql(MY_MYSQL *mysql) {
 /* {{{ mysqli_objects_free_storage
  */
 static void mysqli_objects_free_storage(zend_object *object TSRMLS_DC)
+{
+       mysqli_object   *intern = (mysqli_object *)object;
+       
+       zend_objects_free_object_storage(&(intern->zo) TSRMLS_CC);
+}
+/* }}} */
+
+/* {{{ mysqli_objects_destroy_object
+ */
+static void mysqli_objects_destroy_object(void *object, zend_object_handle handle TSRMLS_DC)
 {
        mysqli_object   *intern = (mysqli_object *)object;
        MYSQLI_RESOURCE *my_res = (MYSQLI_RESOURCE *)intern->ptr;
 
-       zend_hash_destroy(intern->zo.properties);
-       FREE_HASHTABLE(intern->zo.properties);
+       zend_objects_destroy_object(object, handle TSRMLS_CC);
 
        /* link object */
        if (instanceof_function(intern->zo.ce, mysqli_link_class_entry TSRMLS_CC)) {
                if (my_res && my_res->ptr) {
                        MY_MYSQL *mysql = (MY_MYSQL *)my_res->ptr;
-
-                       mysql_close(mysql->mysql);
+               
+                       if (mysql->mysql) {
+                               mysql_close(mysql->mysql);
+                       }
 
                        php_clear_mysql(mysql);
                        efree(mysql);
@@ -146,8 +157,8 @@ static void mysqli_objects_free_storage(zend_object *object TSRMLS_DC)
                        mysql_free_result(my_res->ptr);
                }
        }
+       intern->ptr = NULL;
        my_efree(my_res);
-       efree(object);
 }
 /* }}} */
 
@@ -331,7 +342,7 @@ PHP_MYSQLI_EXPORT(zend_object_value) mysqli_objects_new(zend_class_entry *class_
        zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref,
                                        (void *) &tmp, sizeof(zval *));
 
-       retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t) zend_objects_destroy_object, (zend_objects_free_object_storage_t) mysqli_objects_free_storage, NULL TSRMLS_CC);
+       retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t) mysqli_objects_destroy_object, (zend_objects_free_object_storage_t) mysqli_objects_free_storage, NULL TSRMLS_CC);
        retval.handlers = &mysqli_object_handlers;
 
        return retval;