Bug#29948: Unchecked NULL pointer caused server crash.

The cli_read_binary_rows function is used to fetch data from the server
after a prepared statement execution. It accepts a statement handler and gets
the connection handler from it. But when the auto-reconnect option is set
the connection handler is reset to NULL after reconnection because the
prepared statement is lost and the handler became useless. This case
wasn't checked in the cli_read_binary_rows function and caused server crash.

Now the cli_read_binary_rows function checks the connection handler to be
not NULL and returns an error if it is.


tests/mysql_client_test.c:
  Added a test case for the bug#29948: Unchecked NULL pointer caused server crash.
libmysql/libmysql.c:
  Bug#29948: Unchecked NULL pointer caused server crash.
  Now the cli_read_binary_rows function checks the connection handler to be
  not NULL and returns an error if it is.

1 files changed, 9 insertions, 1 deletions

diff --git a/libmysql/libmysql.c b/libmysql/libmysql.c
index 1a0aae414ed..85c56a7ea40 100644
--- a/libmysql/libmysql.c
+++ b/libmysql/libmysql.c
@@ -4679,9 +4679,17 @@ int cli_read_binary_rows(MYSQL_STMT *stmt)
   MYSQL      *mysql= stmt->mysql;
   MYSQL_DATA *result= &stmt->result;
   MYSQL_ROWS *cur, **prev_ptr= &result->data;
-  NET        *net = &mysql->net;
+  NET        *net;
+
+  if (!mysql)
+  {
+    set_stmt_error(stmt, CR_SERVER_LOST, unknown_sqlstate);
+    return 1;
+  }
+
   DBUG_ENTER("cli_read_binary_rows");
 
+  net = &mysql->net;
   mysql= mysql->last_used_con;
 
   while ((pkt_len= cli_safe_read(mysql)) != packet_error)