From: Antony Dovgal <tony2001@php.net>
Date: Mon, 27 Jun 2005 18:22:00 +0000 (+0000)
Subject: MFH: fix #33491 (crash after extending MySQLi internal class)
X-Git-Tag: php-5.0.5RC1~119
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=60864957134402aabf2a7d8664f28483e2634674;p=php

MFH: fix #33491 (crash after extending MySQLi internal class)
---

diff --git a/NEWS b/NEWS
index b5c1cab3e1..cb6877d96f 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,7 @@ PHP                                                                        NEWS
 - Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey)
 - Fixed memory corruption in stristr(). (Derick)
 - Fixed segfaults when CURL callback functions throw exception. (Tony)
+- Fixed bug #33491 (crash after extending MySQLi internal class). (Tony)
 - Fixed bug #33340 (CLI Crash when calling php:function from XSLT). (Rob)
 - Fixed bug #33277 (private method accessed by child class). (Dmitry)
 - Fixed bug #33268 (iconv_strlen() works only with a parameter of < 3 in 
diff --git a/ext/mysqli/mysqli.c b/ext/mysqli/mysqli.c
index ac7ab3c554..45116f8157 100644
--- a/ext/mysqli/mysqli.c
+++ b/ext/mysqli/mysqli.c
@@ -118,19 +118,30 @@ void php_clear_mysql(MY_MYSQL *mysql) {
 /* {{{ mysqli_objects_free_storage
  */
 static void mysqli_objects_free_storage(zend_object *object TSRMLS_DC)
+{
+	mysqli_object 	*intern = (mysqli_object *)object;
+	
+	zend_objects_free_object_storage(&(intern->zo) TSRMLS_CC);
+}
+/* }}} */
+
+/* {{{ mysqli_objects_destroy_object
+ */
+static void mysqli_objects_destroy_object(void *object, zend_object_handle handle TSRMLS_DC)
 {
 	mysqli_object 	*intern = (mysqli_object *)object;
 	MYSQLI_RESOURCE	*my_res = (MYSQLI_RESOURCE *)intern->ptr;
 
-	zend_hash_destroy(intern->zo.properties);
-	FREE_HASHTABLE(intern->zo.properties);
+	zend_objects_destroy_object(object, handle TSRMLS_CC);
 
 	/* link object */
 	if (instanceof_function(intern->zo.ce, mysqli_link_class_entry TSRMLS_CC)) {
 		if (my_res && my_res->ptr) {
 			MY_MYSQL *mysql = (MY_MYSQL *)my_res->ptr;
-
-			mysql_close(mysql->mysql);
+		
+			if (mysql->mysql) {
+				mysql_close(mysql->mysql);
+			}
 
 			php_clear_mysql(mysql);
 			efree(mysql);
@@ -146,8 +157,8 @@ static void mysqli_objects_free_storage(zend_object *object TSRMLS_DC)
 			mysql_free_result(my_res->ptr);
 		}
 	}
+	intern->ptr = NULL;
 	my_efree(my_res);
-	efree(object);
 }
 /* }}} */
 
@@ -331,7 +342,7 @@ PHP_MYSQLI_EXPORT(zend_object_value) mysqli_objects_new(zend_class_entry *class_
 	zend_hash_copy(intern->zo.properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref,
 					(void *) &tmp, sizeof(zval *));
 
-	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t) zend_objects_destroy_object, (zend_objects_free_object_storage_t) mysqli_objects_free_storage, NULL TSRMLS_CC);
+	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t) mysqli_objects_destroy_object, (zend_objects_free_object_storage_t) mysqli_objects_free_storage, NULL TSRMLS_CC);
 	retval.handlers = &mysqli_object_handlers;
 
 	return retval;