Fixed bug #36420 (segfault when access result->num_rows after calling

result->close())

diff --git a/NEWS b/NEWS
index 16fcce557dae3727dd2fdcf0f202982151d7d4ee..4ebc17c50bec636525bcf86295448f41c7856f18 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,8 @@ PHP                                                                        NEWS
 - Added ReflectionClass::newInstanceArgs($args). (Marcus)
 - Added imap_savebody() that allows message body to be written to a file.
   (Mike)
+- Fixed bug #36420 (segfault when access result->num_rows after calling 
+  result->close()). (Ilia)
 - Fixed bug #36403 (oci_execute() no longer supports OCI_DESCRIBE_ONLY). 
   (Tony)
 - Fixed bug #36400 (Custom 5xx error does not return correct HTTP response 

diff --git a/ext/mysqli/mysqli.c b/ext/mysqli/mysqli.c
index 0d1b34db9eaa6e59c9c6c5586c12594856efdddc..47539b717c07a6a59ba5f8a3f3d593b222dd822a 100644 (file)
--- a/ext/mysqli/mysqli.c
+++ b/ext/mysqli/mysqli.c
@@ -198,6 +198,11 @@ zval *mysqli_read_property(zval *object, zval *member, int type TSRMLS_DC)
 
        ret = FAILURE;
        obj = (mysqli_object *)zend_objects_get_address(object TSRMLS_CC);
+       /* object was already destroyed */
+       if (!obj->ptr) {
+               retval = EG(uninitialized_zval_ptr);
+               return(retval);
+       }
 
        if (member->type != IS_STRING) {
                tmp_member = *member;