diff options
| author | Xinchen Hui <laruence@php.net> | 2012-11-30 14:28:32 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2012-11-30 14:28:32 +0800 |
| commit | 40fabf68edd5524b9ce0cda925d6c7888d8441c3 (patch) | |
| tree | d338d3752e0f8bb48a37b41317233b387f394a12 | |
| parent | dc2192c08766939700260128684255772ba4296f (diff) | |
| download | php-git-40fabf68edd5524b9ce0cda925d6c7888d8441c3.tar.gz | |
Fixed bug #63398 (Segfault when polling closed link)
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/mysqli/mysqli_nonapi.c | 10 | ||||
| -rw-r--r-- | ext/mysqli/tests/bug63398.phpt | 34 |
3 files changed, 45 insertions, 2 deletions
@@ -28,6 +28,9 @@ PHP NEWS - Imap: . Fixed Bug #63126 DISABLE_AUTHENTICATOR ignores array (Remi) +- MySQLnd: + . Fixed bug #63398 (Segfault when polling closed link). (Laruence) + - Reflection: . Fixed Bug #63614 (Fatal error on Reflection). (Laruence) diff --git a/ext/mysqli/mysqli_nonapi.c b/ext/mysqli/mysqli_nonapi.c index 0ef67a2c44..a6cbcf1748 100644 --- a/ext/mysqli/mysqli_nonapi.c +++ b/ext/mysqli/mysqli_nonapi.c @@ -607,7 +607,7 @@ static int mysqlnd_zval_array_from_mysqlnd_array(MYSQLND **in_array, zval *out_a MYSQLND **p = in_array; HashTable *new_hash; zval **elem, **dest_elem; - int ret = 0; + int ret = 0, i = 0; ALLOC_HASHTABLE(new_hash); zend_hash_init(new_hash, zend_hash_num_elements(Z_ARRVAL_P(out_array)), NULL, ZVAL_PTR_DTOR, 0); @@ -616,13 +616,19 @@ static int mysqlnd_zval_array_from_mysqlnd_array(MYSQLND **in_array, zval *out_a zend_hash_get_current_data(Z_ARRVAL_P(out_array), (void **) &elem) == SUCCESS; zend_hash_move_forward(Z_ARRVAL_P(out_array))) { + i++; if (Z_TYPE_PP(elem) != IS_OBJECT || !instanceof_function(Z_OBJCE_PP(elem), mysqli_link_class_entry TSRMLS_CC)) { continue; } { MY_MYSQL *mysql; + MYSQLI_RESOURCE *my_res; mysqli_object *intern = (mysqli_object *)zend_object_store_get_object(*elem TSRMLS_CC); - mysql = (MY_MYSQL *) ((MYSQLI_RESOURCE *)intern->ptr)->ptr; + if (!(my_res = (MYSQLI_RESOURCE *)intern->ptr)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "[%d] Couldn't fetch %s", i, intern->zo.ce->name); + continue; + } + mysql = (MY_MYSQL *) my_res->ptr; if (mysql->mysql == *p) { zend_hash_next_index_insert(new_hash, (void *)elem, sizeof(zval *), (void **)&dest_elem); if (dest_elem) { diff --git a/ext/mysqli/tests/bug63398.phpt b/ext/mysqli/tests/bug63398.phpt new file mode 100644 index 0000000000..6dffa8c1f6 --- /dev/null +++ b/ext/mysqli/tests/bug63398.phpt @@ -0,0 +1,34 @@ +--TEST--
+Bug #63398 (Segfault when polling closed link)
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once("connect.inc");
+if (!$IS_MYSQLND) {
+ die("skip mysqlnd only test");
+}
+?>
+--FILE--
+<?php
+$link = new mysqli('localhost', 'test', NULL, 'test');
+
+mysqli_close($link);
+
+$read = $error = $reject = array();
+$read[] = $error[] = $reject[] = $link;
+
+mysqli_poll($read, $error, $reject, 1);
+
+echo "okey";
+?>
+--EXPECTF--
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d
+
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d
+
+Warning: mysqli_poll(): No stream arrays were passed in %sbug63398.php on line %d
+
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d
+
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d
+okey
|