From: Antony Dovgal <tony2001@php.net>
Date: Thu, 16 Feb 2006 16:08:52 +0000 (+0000)
Subject: fix #36420 (segfault when access result->num_rows after calling result->close())
X-Git-Tag: RELEASE_1_2~191
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=29d3ee55d583da0ee8132fcc008cc72a78ce642f;p=php

fix #36420 (segfault when access result->num_rows after calling result->close())
---

diff --git a/ext/mysqli/mysqli_prop.c b/ext/mysqli/mysqli_prop.c
index 3318944cc7..19db5bc1de 100644
--- a/ext/mysqli/mysqli_prop.c
+++ b/ext/mysqli/mysqli_prop.c
@@ -40,13 +40,34 @@
 MYSQL *p; \
 ALLOC_ZVAL(*retval);\
 CHECK_OBJECT();\
-p = (MYSQL *)((MY_MYSQL *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr)->mysql;
+if (!obj->ptr || !(MY_MYSQL *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr) { \
+	php_error_docref(NULL TSRMLS_CC, E_WARNING, "Couldn't fetch %s", obj->zo.ce->name);\
+	ZVAL_NULL(*retval);\
+	return SUCCESS; \
+} else if (!obj->valid) { \
+	php_error_docref(NULL TSRMLS_CC, E_WARNING, "invalid resource %s", obj->zo.ce->name);\
+	ZVAL_NULL(*retval);\
+	return SUCCESS; \
+} else { \
+	p = (MYSQL *)((MY_MYSQL *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr)->mysql; \
+}
 
 #define MYSQLI_GET_RESULT() \
 MYSQL_RES *p; \
 ALLOC_ZVAL(*retval);\
 CHECK_OBJECT();\
-p = (MYSQL_RES *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr
+if (!obj->ptr) { \
+	php_error_docref(NULL TSRMLS_CC, E_WARNING, "Couldn't fetch %s", obj->zo.ce->name);\
+	ZVAL_NULL(*retval);\
+	return SUCCESS; \
+} else if (!obj->valid) { \
+	php_error_docref(NULL TSRMLS_CC, E_WARNING, "invalid resource %s", obj->zo.ce->name);\
+	ZVAL_NULL(*retval);\
+	return SUCCESS; \
+} else { \
+	p = (MYSQL_RES *)((MYSQLI_RESOURCE *)(obj->ptr))->ptr; \
+}
+
 
 #define MYSQLI_GET_STMT() \
 MYSQL_STMT *p; \
diff --git a/ext/mysqli/tests/bug36420.phpt b/ext/mysqli/tests/bug36420.phpt
new file mode 100644
index 0000000000..d35485e7fd
--- /dev/null
+++ b/ext/mysqli/tests/bug36420.phpt
@@ -0,0 +1,25 @@
+--TEST--
+bug #36420 (segfault when access result->num_rows after calling result->close())
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+include "connect.inc";
+$mysqli = mysqli_connect($host, $user, $passwd);
+
+$result = $mysqli->query('select 1');
+
+$result->close();
+echo $result->num_rows;
+
+$mysqli->close();
+echo $result->num_rows;
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Warning: main(): Couldn't fetch mysqli_result in %s on line %d
+
+Warning: main(): Couldn't fetch mysqli_result in %s on line %d
+Done