From 40fabf68edd5524b9ce0cda925d6c7888d8441c3 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Fri, 30 Nov 2012 14:28:32 +0800
Subject: Fixed bug #63398 (Segfault when polling closed link)

---
 NEWS                           |  3 +++
 ext/mysqli/mysqli_nonapi.c     | 10 ++++++++--
 ext/mysqli/tests/bug63398.phpt | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 ext/mysqli/tests/bug63398.phpt

diff --git a/NEWS b/NEWS
index 53f0112028..68a88ed08c 100644
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,9 @@ PHP                                                                        NEWS
 - Imap:
   . Fixed Bug #63126 DISABLE_AUTHENTICATOR ignores array (Remi)
 
+- MySQLnd:
+  . Fixed bug #63398 (Segfault when polling closed link). (Laruence)
+
 - Reflection:
   . Fixed Bug #63614 (Fatal error on Reflection). (Laruence)
 
diff --git a/ext/mysqli/mysqli_nonapi.c b/ext/mysqli/mysqli_nonapi.c
index 0ef67a2c44..a6cbcf1748 100644
--- a/ext/mysqli/mysqli_nonapi.c
+++ b/ext/mysqli/mysqli_nonapi.c
@@ -607,7 +607,7 @@ static int mysqlnd_zval_array_from_mysqlnd_array(MYSQLND **in_array, zval *out_a
 	MYSQLND **p = in_array;
 	HashTable *new_hash;
 	zval **elem, **dest_elem;
-	int ret = 0;
+	int ret = 0, i = 0;
 
 	ALLOC_HASHTABLE(new_hash);
 	zend_hash_init(new_hash, zend_hash_num_elements(Z_ARRVAL_P(out_array)), NULL, ZVAL_PTR_DTOR, 0);
@@ -616,13 +616,19 @@ static int mysqlnd_zval_array_from_mysqlnd_array(MYSQLND **in_array, zval *out_a
 		 zend_hash_get_current_data(Z_ARRVAL_P(out_array), (void **) &elem) == SUCCESS;
 		 zend_hash_move_forward(Z_ARRVAL_P(out_array)))
 	{
+		i++;
 		if (Z_TYPE_PP(elem) != IS_OBJECT || !instanceof_function(Z_OBJCE_PP(elem), mysqli_link_class_entry TSRMLS_CC)) {
 			continue;
 		}
 		{
 			MY_MYSQL *mysql;
+			MYSQLI_RESOURCE *my_res;
 			mysqli_object *intern = (mysqli_object *)zend_object_store_get_object(*elem TSRMLS_CC);
-			mysql = (MY_MYSQL *) ((MYSQLI_RESOURCE *)intern->ptr)->ptr;
+			if (!(my_res = (MYSQLI_RESOURCE *)intern->ptr)) {
+		  		php_error_docref(NULL TSRMLS_CC, E_WARNING, "[%d] Couldn't fetch %s", i, intern->zo.ce->name);
+				continue;
+		  	}
+			mysql = (MY_MYSQL *) my_res->ptr;
 			if (mysql->mysql == *p) {
 				zend_hash_next_index_insert(new_hash, (void *)elem, sizeof(zval *), (void **)&dest_elem);
 				if (dest_elem) {
diff --git a/ext/mysqli/tests/bug63398.phpt b/ext/mysqli/tests/bug63398.phpt
new file mode 100644
index 0000000000..6dffa8c1f6
--- /dev/null
+++ b/ext/mysqli/tests/bug63398.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Bug #63398 (Segfault when polling closed link)
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once("connect.inc");
+if (!$IS_MYSQLND) {
+    die("skip mysqlnd only test");
+}
+?>
+--FILE--
+<?php
+$link = new mysqli('localhost', 'test', NULL, 'test');
+
+mysqli_close($link);
+
+$read = $error = $reject = array();
+$read[] = $error[] = $reject[] = $link;
+
+mysqli_poll($read, $error, $reject, 1);
+
+echo "okey";
+?>
+--EXPECTF--
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d
+
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d
+
+Warning: mysqli_poll(): No stream arrays were passed in %sbug63398.php on line %d
+
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d
+
+Warning: mysqli_poll(): [1] Couldn't fetch mysqli in %sbug63398.php on line %d
+okey
-- 
cgit v1.2.1