Bug #66762 [Opn]: Segfault in mysqli_stmt::bind_result() when link closed

Edit report at https://bugs.php.net/bug.php?id=66762&edit=1 ID: 66762 Updated by: remi@php.net Reported by: remi@php.net Summary: Segfault in mysqli_stmt::bind_result() when link closed Status: Open Type: Bug Package: MySQLi related Operating System: GNU/Linux PHP Version: 5.4.25 -Assigned To: +Assigned To: andrey Block user comment: N Private report: N New Comment: @Andrey, can you please review this patch ? Previous Comments: ------------------------------------------------------------------------ [2014-02-24 16:36:50] remi@php.net The attached patch seems to be a workaround. Each new statement increment link refcount, so the link will be really destroyed after all statements. ------------------------------------------------------------------------ [2014-02-24 16:35:40] remi@php.net The following patch has been added/updated: Patch Name: mysqli-protect-link.patch Revision: 1393259740 URL: https://bugs.php.net/patch-display.php?bug=66762&patch=mysqli-protect-link.patch&revision=1393259740 ------------------------------------------------------------------------ [2014-02-24 15:05:03] remi@php.net Description: ------------ Trying to use a Mysqli_Stmt object after the Mysql object is clean result in segfault. Notice: only with libmysqlclient (no segfault with mysqlnd). I haven't find a simple solution to check if the link oject is still valid from the stmt object... Test script: --------------- $mysqli = new mysqli($host, $user, $pass, $db); $read_stmt = $mysqli->prepare("SELECT 1"); $mysqli = null; $read_stmt->bind_result($data); Expected result: ---------------- no segfault. Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. (gdb) bt #0 0x00007ffff7aedf3c in mysql_stmt_bind_result () from /usr/lib64/mysql/libmysqlclient.so.18 #1 0x0000000000474b59 in mysqli_stmt_bind_result_do_bind (start=0, argc=<optimized out>, args=0x7ffff7ab7cb8, stmt=0x7ffff7ab7560) at /tmp/php-5.5.9/ext/mysqli/mysqli_api.c:430 #2 zif_mysqli_stmt_bind_result (ht=<optimized out>, return_value=0x7ffff7ab8dd8, return_value_ptr=<optimized out>, this_ptr=<optimized out>, return_value_used=<optimized out>) at /tmp/php-5.5.9/ext/mysqli/mysqli_api.c:509 #3 0x000000000062667a in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7a81260) at /tmp/php-5.5.9/Zend/zend_vm_execute.h:550 #4 0x00000000005a2b38 in execute_ex (execute_data=0x7ffff7a81260) at /tmp/php-5.5.9/Zend/zend_vm_execute.h:363 #5 0x000000000057c14d in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /tmp/php-5.5.9/Zend/zend.c:1316 #6 0x000000000051dae2 in php_execute_script (primary_file=primary_file@entry=0x7fffffffc8b0) at /tmp/php-5.5.9/main/main.c:2506 #7 0x0000000000628734 in do_cli (argc=2, argv=0x9be8b0) at /tmp/php-5.5.9/sapi/cli/php_cli.c:994 #8 0x000000000041a107 in main (argc=2, argv=0x9be8b0) at /tmp/php-5.5.9/sapi/cli/php_cli.c:1378 (gdb) #0 0x00007ffff7aedf3c in mysql_stmt_bind_result () from /usr/lib64/mysql/libmysqlclient.so.18 #1 0x0000000000474b59 in mysqli_stmt_bind_result_do_bind (start=0, argc=<optimized out>, args=0x7ffff7ab7cb8, stmt=0x7ffff7ab7560) at /tmp/php-5.5.9/ext/mysqli/mysqli_api.c:430 #2 zif_mysqli_stmt_bind_result (ht=<optimized out>, return_value=0x7ffff7ab8dd8, return_value_ptr=<optimized out>, this_ptr=<optimized out>, return_value_used=<optimized out>) at /tmp/php-5.5.9/ext/mysqli/mysqli_api.c:509 #3 0x000000000062667a in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7a81260) at /tmp/php-5.5.9/Zend/zend_vm_execute.h:550 #4 0x00000000005a2b38 in execute_ex (execute_data=0x7ffff7a81260) at /tmp/php-5.5.9/Zend/zend_vm_execute.h:363 #5 0x000000000057c14d in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /tmp/php-5.5.9/Zend/zend.c:1316 #6 0x000000000051dae2 in php_execute_script (primary_file=primary_file@entry=0x7fffffffc8b0) at /tmp/php-5.5.9/main/main.c:2506 #7 0x0000000000628734 in do_cli (argc=2, argv=0x9be8b0) at /tmp/php-5.5.9/sapi/cli/php_cli.c:994 #8 0x000000000041a107 in main (argc=2, argv=0x9be8b0) at /tmp/php-5.5.9/sapi/cli/php_cli.c:1378 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66762&edit=1