fix #34818 (new mysqli_stmt() and several others crash if the first parameter is...

diff --git a/NEWS b/NEWS
index a4bebec4ec61682b8b1fb21d62a9392d8e32d79b..a6ba4375e87e4900946bd7772f6903d8dd52774d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -43,6 +43,8 @@ PHP                                                                        NEWS
 - Fixed "make test" to work for phpized extensions. (Hartmut, Jani)
 - Fixed failing queries (FALSE returned) with mysqli_query() on 64 bit systems.
   (Andrey)
+- Fixed bug #34818 (several functions crash when invalid mysqli_link object 
+  is passed). (Tony)
 - Fixed bug #34810 (mysqli::init() and others use wrong $this pointer
   without checks). (Tony)
 - Fixed bug #34809 (FETCH_INTO in PDO crashes without a destination object).

diff --git a/ext/mysqli/mysqli.c b/ext/mysqli/mysqli.c
index 436cc3ccef7b956b915678a054c5097917d00b14..e78558a727c7c584a6dd96a722221c99cca79fc9 100644 (file)
--- a/ext/mysqli/mysqli.c
+++ b/ext/mysqli/mysqli.c
@@ -652,33 +652,34 @@ Parameters:
 ZEND_FUNCTION(mysqli_stmt_construct)
 {
        MY_MYSQL                        *mysql;
-       zval                            **mysql_link, **statement;
+       zval                            *mysql_link;
        MY_STMT                         *stmt;
        MYSQLI_RESOURCE         *mysqli_resource;
+       char                            *statement;
+       int                                     stmt_len;
 
        switch (ZEND_NUM_ARGS())
        {
                case 1:  /* mysql_stmt_init */
-               if (zend_get_parameters_ex(1, &mysql_link)==FAILURE) {
+               if (zend_parse_parameters(1, "O", &mysql_link, mysqli_link_class_entry)==FAILURE) {
                                return;
                        }
-                       MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, mysql_link, "mysqli_link");
+                       MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, &mysql_link, "mysqli_link");
 
                        stmt = (MY_STMT *)ecalloc(1,sizeof(MY_STMT));
 
                        stmt->stmt = mysql_stmt_init(mysql->mysql);
                break;
                case 2:
-               if (zend_get_parameters_ex(2, &mysql_link, &statement)==FAILURE) {
+               if (zend_parse_parameters(2, "Os", &mysql_link, mysqli_link_class_entry, &statement, &stmt_len)==FAILURE) {
                                return;
                        }
-                       MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, mysql_link, "mysqli_link");
-                       convert_to_string_ex(statement);
+                       MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, &mysql_link, "mysqli_link");
 
                        stmt = (MY_STMT *)ecalloc(1,sizeof(MY_STMT));
        
                        if ((stmt->stmt = mysql_stmt_init(mysql->mysql))) {
-                               mysql_stmt_prepare(stmt->stmt, Z_STRVAL_PP(statement), strlen(Z_STRVAL_PP(statement)));
+                               mysql_stmt_prepare(stmt->stmt, statement, stmt_len);
                        }
                break;
                default:
@@ -708,27 +709,26 @@ ZEND_FUNCTION(mysqli_result_construct)
 {
        MY_MYSQL                        *mysql;
        MYSQL_RES                       *result;
-       zval                            **mysql_link, **mode;
+       zval                            *mysql_link;
        MYSQLI_RESOURCE         *mysqli_resource;
-       int                                     resmode = MYSQLI_STORE_RESULT;
+       long                            resmode = MYSQLI_STORE_RESULT;
 
        switch (ZEND_NUM_ARGS()) {
                case 1:
-               if (zend_get_parameters_ex(1, &mysql_link)==FAILURE) {
+               if (zend_parse_parameters(1, "O", &mysql_link, mysqli_link_class_entry)==FAILURE) {
                                return;
                        }
                break;
                case 2:
-               if (zend_get_parameters_ex(2, &mysql_link, &mode)==FAILURE) {
+               if (zend_parse_parameters(2, "Ol", &mysql_link, mysqli_link_class_entry, &resmode)==FAILURE) {
                                return;
                        }
-                       resmode = Z_LVAL_PP(mode);
                break;
                default:
                        WRONG_PARAM_COUNT;
        }
 
-       MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, mysql_link, "mysqli_link");
+       MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, &mysql_link, "mysqli_link");
 
        result = (resmode == MYSQLI_STORE_RESULT) ? mysql_store_result(mysql->mysql) :
                                                                                                mysql_use_result(mysql->mysql);

diff --git a/ext/mysqli/mysqli_warning.c b/ext/mysqli/mysqli_warning.c
index 3ea578f6c78d81d4645b8ab31a28780de40d8701..10e49697cb867dc5f2477f9d533a98a0c61bb9bd 100644 (file)
--- a/ext/mysqli/mysqli_warning.c
+++ b/ext/mysqli/mysqli_warning.c
@@ -166,7 +166,7 @@ int mysqli_warning_errno(mysqli_object *obj, zval **retval TSRMLS_DC)
 /* {{{ mysqli_warning_construct(object obj) */
 PHP_METHOD(mysqli_warning, __construct)
 {
-       zval                    **z;
+       zval                    *z;
        mysqli_object   *obj;
        MYSQL                   *hdl;
        MYSQLI_WARNING  *w;
@@ -175,18 +175,18 @@ PHP_METHOD(mysqli_warning, __construct)
        if (ZEND_NUM_ARGS() != 1) {
                WRONG_PARAM_COUNT;
        }
-       if (zend_get_parameters_ex(1, &z)==FAILURE) {
+       if (zend_parse_parameters(1, "o", &z)==FAILURE) {
                return;
        }
-       obj = (mysqli_object *)zend_object_store_get_object(*(z) TSRMLS_CC);\
+       obj = (mysqli_object *)zend_object_store_get_object(z TSRMLS_CC);\
 
        if (obj->zo.ce == mysqli_link_class_entry) {
                MY_MYSQL *mysql;
-               MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, z, "mysqli_link");
+               MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, &z, "mysqli_link");
                hdl = mysql->mysql;
        } else if (obj->zo.ce == mysqli_stmt_class_entry) {
                MY_STMT *stmt;
-               MYSQLI_FETCH_RESOURCE(stmt, MY_STMT *, z, "mysqli_stmt");
+               MYSQLI_FETCH_RESOURCE(stmt, MY_STMT *, &z, "mysqli_stmt");
                hdl = stmt->stmt->mysql;
        } else {
                RETURN_FALSE;