Merge branch 'PHP-5.4' into PHP-5.5

4 files changed, 44 insertions, 6 deletions

diff --git a/ext/mysqli/mysqli_nonapi.c b/ext/mysqli/mysqli_nonapi.c
index 2b6a1af0ed..c01482fe79 100644
--- a/ext/mysqli/mysqli_nonapi.c
+++ b/ext/mysqli/mysqli_nonapi.c
@@ -680,7 +680,7 @@ static int mysqlnd_zval_array_from_mysqlnd_array(MYSQLND **in_array, zval *out_a
 	MYSQLND **p = in_array;
 	HashTable *new_hash;
 	zval **elem, **dest_elem;
-	int ret = 0;
+	int ret = 0, i = 0;
 
 	ALLOC_HASHTABLE(new_hash);
 	zend_hash_init(new_hash, zend_hash_num_elements(Z_ARRVAL_P(out_array)), NULL, ZVAL_PTR_DTOR, 0);
@@ -689,13 +689,19 @@ static int mysqlnd_zval_array_from_mysqlnd_array(MYSQLND **in_array, zval *out_a
 		 zend_hash_get_current_data(Z_ARRVAL_P(out_array), (void **) &elem) == SUCCESS;
 		 zend_hash_move_forward(Z_ARRVAL_P(out_array)))
 	{
+		i++;
 		if (Z_TYPE_PP(elem) != IS_OBJECT || !instanceof_function(Z_OBJCE_PP(elem), mysqli_link_class_entry TSRMLS_CC)) {
 			continue;
 		}
 		{
 			MY_MYSQL *mysql;
+			MYSQLI_RESOURCE *my_res;
 			mysqli_object *intern = (mysqli_object *)zend_object_store_get_object(*elem TSRMLS_CC);
-			mysql = (MY_MYSQL *) ((MYSQLI_RESOURCE *)intern->ptr)->ptr;
+			if (!(my_res = (MYSQLI_RESOURCE *)intern->ptr)) {
+		  		php_error_docref(NULL TSRMLS_CC, E_WARNING, "[%d] Couldn't fetch %s", i, intern->zo.ce->name);
+				continue;
+		  	}
+			mysql = (MY_MYSQL *) my_res->ptr;
 			if (mysql->mysql == *p) {
 				zend_hash_next_index_insert(new_hash, (void *)elem, sizeof(zval *), (void **)&dest_elem);
 				if (dest_elem) {
diff --git a/ext/mysqli/tests/bug63398.phpt b/ext/mysqli/tests/bug63398.phpt
new file mode 100644
index 0000000000..6dffa8c1f6
--- /dev/null
+++ b/ext/mysqli/tests/bug63398.phpt
@@ -0,0 +1,34 @@
+--TEST--

+Bug #63398 (Segfault when polling closed link)

+--SKIPIF--

+<?php

+require_once('skipif.inc');

+require_once("connect.inc");

+if (!$IS_MYSQLND) {

+    die("skip mysqlnd only test");

+}

+?>

+--FILE--

+<?php

+$link = new mysqli('localhost', 'test', NULL, 'test');

+

+mysqli_close($link);

+

+$read = $error = $reject = array();

+$read[] = $error[] = $reject[] = $link;

+

+mysqli_poll($read, $error, $reject, 1);

+

+echo "okey";

+?>

+--EXPECTF--

+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d

+

+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d

+

+Warning: mysqli_poll(): No stream arrays were passed in %sbug63398.php on line %d

+

+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d

+

+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d

+okey

diff --git a/main/output.c b/main/output.c
index 534e0b6278..63f315e23c 100644
--- a/main/output.c
+++ b/main/output.c
@@ -297,7 +297,6 @@ PHPAPI int php_output_clean(TSRMLS_D)
 	php_output_context context;
 
 	if (OG(active) && (OG(active)->flags & PHP_OUTPUT_HANDLER_CLEANABLE)) {
-		OG(active)->buffer.used = 0;
 		php_output_context_init(&context, PHP_OUTPUT_HANDLER_CLEAN TSRMLS_CC);
 		php_output_handler_op(OG(active), &context);
 		php_output_context_dtor(&context);
@@ -1226,7 +1225,6 @@ static inline int php_output_stack_pop(int flags TSRMLS_DC)
 			/* signal that we're cleaning up */
 			if (flags & PHP_OUTPUT_POP_DISCARD) {
 				context.op |= PHP_OUTPUT_HANDLER_CLEAN;
-				orphan->buffer.used = 0;
 			}
 			php_output_handler_op(orphan, &context);
 		}
diff --git a/tests/output/ob_017.phpt b/tests/output/ob_017.phpt
index 070df603fc..517fafe991 100644
--- a/tests/output/ob_017.phpt
+++ b/tests/output/ob_017.phpt
@@ -27,8 +27,8 @@ Array
     [0] => 1: yes
     [1] => 4: !
 
-    [2] => 2: 
+    [2] => 2: no
     [3] => 0: yes!
 
-    [4] => 10: 
+    [4] => 10: no
 )