Fixing a crash which must have existed since PHP 5.0. At least the crash can be repro...

when using mysqlnd.

diff --git a/ext/mysqli/mysqli_api.c b/ext/mysqli/mysqli_api.c
index 93f5aaad13bfb20f59685261a52bd12509695725..f69f6e76341cb6e4fa7f568ea065357df7d9c15e 100644 (file)
--- a/ext/mysqli/mysqli_api.c
+++ b/ext/mysqli/mysqli_api.c
@@ -409,7 +409,7 @@ mysqli_stmt_bind_result_do_bind(MY_STMT *stmt, zval ***args, unsigned int argc,
                                bind[ofs].buffer = stmt->result.buf[ofs].val;
                                bind[ofs].is_null = &stmt->result.is_null[ofs];
                                bind[ofs].buffer_length = stmt->result.buf[ofs].buflen;
-                               bind[ofs].length = &stmt->result.buf[ofs].buflen;
+                               bind[ofs].length = &stmt->result.buf[ofs].output_len;
                                break;
                        }
                        default:
@@ -955,7 +955,7 @@ void mysqli_stmt_fetch_libmysql(INTERNAL_FUNCTION_PARAMETERS)
                                                        } else
 #endif
                                                        {
-                                                               copy_len = stmt->result.buf[i].buflen;
+                                                               copy_len = stmt->result.buf[i].output_len;
                                                        }
                                                        if (!IS_BINARY_DATA(fields[i])) {
                                                                ZVAL_UTF8_STRINGL(stmt->result.vars[i], stmt->result.buf[i].val,

diff --git a/ext/mysqli/php_mysqli_structs.h b/ext/mysqli/php_mysqli_structs.h
index 3367010fa76d0001093f3f931e777007e78994db..086543006727a95fe9e25cc269d1898159e9c06b 100644 (file)
--- a/ext/mysqli/php_mysqli_structs.h
+++ b/ext/mysqli/php_mysqli_structs.h
@@ -82,10 +82,10 @@ typedef struct {
        UErrorCode              status;         /* error code */
 } MYSQLI_STRING;
 
-
 typedef struct {
-       ulong           buflen;
        char            *val;
+       ulong           buflen;
+       ulong           output_len;
        ulong           type;
 } VAR_BUFFER;
 

diff --git a/ext/mysqli/tests/005.phpt b/ext/mysqli/tests/005.phpt
index 69e04c7a6044fec68b752e0bb430d338c7a9b060..563b10359d0bfc89b0c85bec952a10fceccd69e6 100644 (file)
--- a/ext/mysqli/tests/005.phpt
+++ b/ext/mysqli/tests/005.phpt
@@ -32,6 +32,9 @@ require_once('skipifconnectfailure.inc');
 
        var_dump($test);
 
+       /* this will crash with libmysql from PHP 5.0.6 (or earlier) to 5.3.0 */
+       mysqli_fetch($stmt);
+
        mysqli_stmt_close($stmt);
        mysqli_query($link, "DROP TABLE IF EXISTS test_bind_fetch");
        mysqli_close($link);