OOM fixes

3 files changed, 20 insertions, 9 deletions

diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c
index 43ef152dda..5a3fda5e98 100644
--- a/ext/mysqlnd/mysqlnd_net.c
+++ b/ext/mysqlnd/mysqlnd_net.c
@@ -942,7 +942,7 @@ PHPAPI void ** _mysqlnd_plugin_get_plugin_net_data(const MYSQLND_NET * net, unsi
 /* }}} */
 
 
-/* {{{ mysqlnd_res_meta_get_methods */
+/* {{{ mysqlnd_net_get_methods */
 PHPAPI struct st_mysqlnd_net_methods *
 mysqlnd_net_get_methods()
 {
diff --git a/ext/mysqlnd/mysqlnd_ps.c b/ext/mysqlnd/mysqlnd_ps.c
index 778663b08a..1c7f60dd57 100644
--- a/ext/mysqlnd/mysqlnd_ps.c
+++ b/ext/mysqlnd/mysqlnd_ps.c
@@ -237,21 +237,24 @@ mysqlnd_stmt_skip_metadata(MYSQLND_STMT * s TSRMLS_DC)
 	MYSQLND_STMT_DATA * stmt = s->data;
 	/* Follows parameter metadata, we have just to skip it, as libmysql does */
 	unsigned int i = 0;
-	enum_func_status ret = PASS;
+	enum_func_status ret = FAIL;
 	MYSQLND_PACKET_RES_FIELD * field_packet;
 
 	DBG_ENTER("mysqlnd_stmt_skip_metadata");
 	DBG_INF_FMT("stmt=%lu", stmt->stmt_id);
 
 	field_packet = stmt->conn->protocol->m.get_result_field_packet(stmt->conn->protocol, FALSE TSRMLS_CC);
-	field_packet->skip_parsing = TRUE;
-	for (;i < stmt->param_count; i++) {
-		if (FAIL == PACKET_READ(field_packet, stmt->conn)) {
-			ret = FAIL;
-			break;
+	if (field_packet) {
+		ret = PASS;
+		field_packet->skip_parsing = TRUE;
+		for (;i < stmt->param_count; i++) {
+			if (FAIL == PACKET_READ(field_packet, stmt->conn)) {
+				ret = FAIL;
+				break;
+			}
 		}
+		PACKET_FREE(field_packet);
 	}
-	PACKET_FREE(field_packet);
 
 	DBG_RETURN(ret);
 }
diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c
index 39a3c94b04..5b1bca906e 100644
--- a/ext/mysqlnd/mysqlnd_wireprotocol.c
+++ b/ext/mysqlnd/mysqlnd_wireprotocol.c
@@ -1024,6 +1024,10 @@ php_mysqlnd_rset_field_read(void *_packet, MYSQLND *conn TSRMLS_DC)
 		BAIL_IF_NO_MORE_DATA;
 		DBG_INF_FMT("Def found, length %lu, persistent=%d", len, packet->persistent_alloc);
 		meta->def = mnd_pemalloc(len + 1, packet->persistent_alloc);
+		if (!meta->def) {
+			SET_OOM_ERROR(conn->error_info);
+			DBG_RETURN(FAIL);		
+		}
 		memcpy(meta->def, p, len);
 		meta->def[len] = '\0';
 		meta->def_length = len;
@@ -1032,6 +1036,11 @@ php_mysqlnd_rset_field_read(void *_packet, MYSQLND *conn TSRMLS_DC)
 
 	DBG_INF_FMT("allocing root. persistent=%d", packet->persistent_alloc);
 	root_ptr = meta->root = mnd_pemalloc(total_len, packet->persistent_alloc);
+	if (!root_ptr) {
+		SET_OOM_ERROR(conn->error_info);
+		DBG_RETURN(FAIL);	
+	}
+	
 	meta->root_len = total_len;
 	/* Now do allocs */
 	if (meta->catalog && meta->catalog != mysqlnd_empty_string) {
@@ -1100,7 +1109,6 @@ static
 void php_mysqlnd_rset_field_free_mem(void *_packet, zend_bool alloca TSRMLS_DC)
 {
 	MYSQLND_PACKET_RES_FIELD *p= (MYSQLND_PACKET_RES_FIELD *) _packet;
-
 	/* p->metadata was passed to us as temporal buffer */
 	if (!alloca) {
 		mnd_pefree(p, p->header.persistent);