MFH: fix for bug #32956

     fixed memleak in mysql_close
     fixed data truncation in test 009.phpt

4 files changed, 49 insertions, 7 deletions

diff --git a/NEWS b/NEWS
index 0a120d1e93..80752ea67c 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,7 @@ PHP                                                                        NEWS
 - Fixed ext/mysqli to allocate less memory when fetching bound params
   of type (MEDIUM|LONG)BLOB/(MEDIUM|LONG)TEXT. (Andrey)
 - Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey)
+- Fixed bug #32956 (mysql_bind_result doesn't support MYSQL_TYPE_NULL). (Georg)
 - Fixed bug #32947 (Incorrect option for mysqli default password). (Georg)
 - Fixed bug #32930 (class extending DOMDocument doesn't clone properly). (Rob)
 - Fixed bug #32852 (Crash with singleton and __destruct when
diff --git a/ext/mysqli/mysqli.c b/ext/mysqli/mysqli.c
index c421a02d50..ac7ab3c554 100644
--- a/ext/mysqli/mysqli.c
+++ b/ext/mysqli/mysqli.c
@@ -66,7 +66,7 @@ void php_free_stmt_bind_buffer(BIND_BUFFER bbuf, int type)
 	for (i=0; i < bbuf.var_cnt; i++) {
 
 		/* free temporary bind buffer */
-		if (type == FETCH_RESULT) {
+		if (type == FETCH_RESULT && bbuf.buf[i].val) {
 			efree(bbuf.buf[i].val);
 		}
 
@@ -129,10 +129,13 @@ static void mysqli_objects_free_storage(zend_object *object TSRMLS_DC)
 	if (instanceof_function(intern->zo.ce, mysqli_link_class_entry TSRMLS_CC)) {
 		if (my_res && my_res->ptr) {
 			MY_MYSQL *mysql = (MY_MYSQL *)my_res->ptr;
-		
+
 			mysql_close(mysql->mysql);
 
-			php_clear_mysql(mysql);		
+			php_clear_mysql(mysql);
+			efree(mysql);
+
+			my_res->ptr = NULL;
 		}
 	} else if (intern->zo.ce == mysqli_stmt_class_entry) { /* stmt object */
 		if (my_res && my_res->ptr) {
@@ -512,6 +515,9 @@ PHP_MINIT_FUNCTION(mysqli)
 	
 	/* bind blob support */
 	REGISTER_LONG_CONSTANT("MYSQLI_NO_DATA", MYSQL_NO_DATA, CONST_CS | CONST_PERSISTENT);
+#ifdef MYSQL_DATA_TRUNCATED
+	REGISTER_LONG_CONSTANT("MYSQLI_DATA_TRUNCATED", MYSQL_DATA_TRUNCATED, CONST_CS | CONST_PERSISTENT);
+#endif
 
 	/* reporting */
 	REGISTER_LONG_CONSTANT("MYSQLI_REPORT_INDEX", MYSQLI_REPORT_INDEX, CONST_CS | CONST_PERSISTENT);
diff --git a/ext/mysqli/mysqli_api.c b/ext/mysqli/mysqli_api.c
index 19e14665bd..ea8a982417 100644
--- a/ext/mysqli/mysqli_api.c
+++ b/ext/mysqli/mysqli_api.c
@@ -301,7 +301,14 @@ PHP_FUNCTION(mysqli_stmt_bind_result)
 				bind[ofs].is_null = &stmt->result.is_null[ofs];
 				bind[ofs].buffer_length = stmt->result.buf[ofs].buflen;
 				break;
-
+			case MYSQL_TYPE_NULL:
+				stmt->result.buf[ofs].type = IS_NULL; 
+				stmt->result.buf[ofs].buflen = 0;
+				bind[ofs].buffer_type = MYSQL_TYPE_NULL;
+				bind[ofs].buffer = 0;
+				bind[ofs].is_null = &stmt->result.is_null[ofs];
+				bind[ofs].buffer_length = 0;
+			break;
 			case MYSQL_TYPE_DATE:
 			case MYSQL_TYPE_TIME:
 			case MYSQL_TYPE_DATETIME:
@@ -425,7 +432,9 @@ PHP_FUNCTION(mysqli_close)
 
 	mysql_close(mysql->mysql);
 	php_clear_mysql(mysql);	
+	efree(mysql);
 	MYSQLI_CLEAR_RESOURCE(&mysql_link);	
+
 	RETURN_TRUE;
 }
 /* }}} */
@@ -618,10 +627,15 @@ PHP_FUNCTION(mysqli_stmt_fetch)
 			memset(stmt->result.buf[i].val, 0, stmt->result.buf[i].buflen);
 		}
 	}
-	if (!(ret = mysql_stmt_fetch(stmt->stmt))) {
+	ret = mysql_stmt_fetch(stmt->stmt);
+#ifdef MYSQL_DATA_TRUNCATED
+	if (!ret || ret == MYSQL_DATA_TRUNCATED) {
+#else
+	if (!ret) {
+#endif
 		for (i = 0; i < stmt->result.var_cnt; i++) {
 			if (stmt->result.vars[i]->type == IS_STRING && stmt->result.vars[i]->value.str.len) {
-		efree(stmt->result.vars[i]->value.str.val);
+				efree(stmt->result.vars[i]->value.str.val);
 			}
 			if (!stmt->result.is_null[i]) {
 				switch (stmt->result.buf[i].type) {
@@ -1008,7 +1022,7 @@ PHP_FUNCTION(mysqli_info)
 PHP_FUNCTION(mysqli_init)
 {
 	MYSQLI_RESOURCE *mysqli_resource;
-	MY_MYSQL *mysql = (MY_MYSQL *)calloc(1, sizeof(MY_MYSQL));
+	MY_MYSQL *mysql = (MY_MYSQL *)ecalloc(1, sizeof(MY_MYSQL));
 
 	if (!(mysql->mysql = mysql_init(NULL))) {
 		efree(mysql);
diff --git a/ext/mysqli/tests/064.phpt b/ext/mysqli/tests/064.phpt
new file mode 100644
index 0000000000..e6df1e4505
--- /dev/null
+++ b/ext/mysqli/tests/064.phpt
@@ -0,0 +1,21 @@
+--TEST--
+NULL binding 
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+	include "connect.inc";
+
+	$mysql = new mysqli($host, $user, $passwd);
+
+	$stmt = new mysqli_stmt($mysql, "SELECT NULL FROM DUAL");
+	$stmt->execute();
+	$stmt->bind_result($foo);
+	$stmt->fetch();
+	$stmt->close();
+	$mysql->close();
+
+	var_dump($foo);
+?>
+--EXPECT--
+NULL