Fixed bug #70272 (Segfault in pdo_mysql)

laruence · laruence · commit dca6d1027a4b · 2015-08-18T18:33:07.000+08:00
diff --git a/NEWS b/NEWS
@@ -46,6 +46,7 @@ PHP                                                                        NEWS
     match). (cmb)
 
 - PDO:
+  . Fixed bug #70272 (Segfault in pdo_mysql). (Laruence)
   . Fixed bug #70221 (persistent sqlite connection + custom function
     segfaults). (Laruence)
 
diff --git a/ext/pdo_mysql/mysql_driver.c b/ext/pdo_mysql/mysql_driver.c
@@ -147,11 +147,9 @@ static int mysql_handle_closer(pdo_dbh_t *dbh)
 	if (H) {
 		if (H->server) {
 			mysql_close(H->server);
-			H->server = NULL;
 		}
 		if (H->einfo.errmsg) {
 			pefree(H->einfo.errmsg, dbh->is_persistent);
-			H->einfo.errmsg = NULL;
 		}
 		pefree(H, dbh->is_persistent);
 		dbh->driver_data = NULL;
diff --git a/ext/pdo_mysql/mysql_statement.c b/ext/pdo_mysql/mysql_statement.c
@@ -88,8 +88,8 @@ static int pdo_mysql_stmt_dtor(pdo_stmt_t *stmt) /* {{{ */
 	}
 #endif
 
-
-	if (S->H->server) {
+	if (IS_OBJ_VALID(EG(objects_store).object_buckets[Z_OBJ_HANDLE(stmt->database_object_handle)])
+		&& (!(GC_FLAGS(Z_OBJ(stmt->database_object_handle)) & IS_OBJ_FREE_CALLED))) {
 		while (mysql_more_results(S->H->server)) {
 			MYSQL_RES *res;
 			if (mysql_next_result(S->H->server) != 0) {
diff --git a/ext/pdo_mysql/tests/bug70272.phpt b/ext/pdo_mysql/tests/bug70272.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #70272 (Segfault in pdo_mysql)
+--SKIPIF--
+<?php
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+?>
+--INI--
+report_memleaks=off
+--FILE--
+<?php
+$a = new Stdclass();
+$a->a = &$a;
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+
+$dummy = new StdClass();
+
+$db = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+$dummy = NULL;
+
+$a->c = $db;
+$a->b = $db->prepare("select 1");
+$a->d = $db->prepare("select 2");
+$a->e = $db->prepare("select 3");
+$a->f = $db->prepare("select 4");
+gc_disable();
+?>
+okey
+--EXPECT--
+okey

Original file line number	Diff line number	Diff line change
`@@ -147,11 +147,9 @@ static int mysql_handle_closer(pdo_dbh_t *dbh)`
`147`	`147`	`if (H) {`
`148`	`148`	`if (H->server) {`
`149`	`149`	`mysql_close(H->server);`
`150`		`- H->server = NULL;`
`151`	`150`	`}`
`152`	`151`	`if (H->einfo.errmsg) {`
`153`	`152`	`pefree(H->einfo.errmsg, dbh->is_persistent);`
`154`		`- H->einfo.errmsg = NULL;`
`155`	`153`	`}`
`156`	`154`	`pefree(H, dbh->is_persistent);`
`157`	`155`	`dbh->driver_data = NULL;`