2 files changed, 17 insertions, 8 deletions

diff --git a/ext/mysqli/mysqli.c b/ext/mysqli/mysqli.c
index 684cddf305..8f9b5119d4 100644
--- a/ext/mysqli/mysqli.c
+++ b/ext/mysqli/mysqli.c
@@ -69,10 +69,6 @@ void php_free_stmt_bind_buffer(BIND_BUFFER bbuf, int type)
 		return;
 	}
 
-	if (bbuf.is_null) {
-		efree(bbuf.is_null);
-	}
-
 	for (i=0; i < bbuf.var_cnt; i++) {
 
 		/* free temporary bind buffer */
@@ -89,9 +85,18 @@ void php_free_stmt_bind_buffer(BIND_BUFFER bbuf, int type)
 		efree(bbuf.vars);
 	}
 
+	/*
+	  Don't free bbuf.is_null for FETCH_RESULT since we have allocated
+	  is_null and buf in one block so we free only buf, which is the beginning
+	  of the block. When FETCH_SIMPLE then buf wasn't allocated together with
+	  buf and we have to free it.
+	*/
 	if (type == FETCH_RESULT) {
 		efree(bbuf.buf);
+	} else if (type == FETCH_SIMPLE){
+		efree(bbuf.is_null);
 	}
+
 	bbuf.var_cnt = 0;
 	return;
 }
diff --git a/ext/mysqli/mysqli_api.c b/ext/mysqli/mysqli_api.c
index 43eb19347c..1dcaec2a5d 100644
--- a/ext/mysqli/mysqli_api.c
+++ b/ext/mysqli/mysqli_api.c
@@ -250,12 +250,16 @@ PHP_FUNCTION(mysqli_stmt_bind_result)
 	}
 
 	bind = (MYSQL_BIND *)ecalloc(var_cnt, sizeof(MYSQL_BIND));
-	stmt->result.buf = (VAR_BUFFER *)ecalloc(var_cnt,sizeof(VAR_BUFFER));
-	stmt->result.is_null = (char *)ecalloc(var_cnt, sizeof(char));
+	{
+		int size;
+		char *p= emalloc(size= var_cnt * (sizeof(char) + sizeof(VAR_BUFFER)));
+		stmt->result.buf = (VAR_BUFFER *) p;
+		stmt->result.is_null = p + var_cnt * sizeof(VAR_BUFFER);
+		memset(p, 0, size);
+	}
 
 	for (i=start; i < var_cnt + start ; i++) {
 		ofs = i - start;
-		stmt->result.is_null[ofs] = 0;
 		col_type = (stmt->stmt->fields) ? stmt->stmt->fields[ofs].type : MYSQL_TYPE_STRING;
 
 		switch (col_type) {
@@ -373,8 +377,8 @@ PHP_FUNCTION(mysqli_stmt_bind_result)
 				efree(stmt->result.buf[i].val);
 			}
 		}
+		/* Don't free stmt->result.is_null because is_null & buf are one block of memory  */
 		efree(stmt->result.buf);
-		efree(stmt->result.is_null);
 		RETVAL_FALSE;
 	} else {
 		stmt->result.var_cnt = var_cnt;