Bug #68754 [NEW]: AV with mysqli doc ref

From: mattficken Operating system: Windows PHP version: 5.6.4 Package: MySQLi related Bug Type: Bug Bug description:AV with mysqli doc ref Description: ------------ mysqli extension calls php_error_docref which calls efree resulting in AV (null pointer read). Stack traces of user-mode application crashes on Windows can (with user consent) be reported to Microsoft (see Windows Error Reporting and Watson). This bug is based on one of those reports. Reported on 5.6.0 (could affect 5.6.4) php-cgi X86 NTS. Watson #73492878194 Actual result: -------------- 0170e350 0fc6e2bb php5!_efree+0x165 [c:\php-sdk\php56\vc11\x86\php-5.6.0\zend\zend_alloc.c @ 2440] 0170e398 0fc6d71b php5!php_verror+0x1bb [c:\php-sdk\php56\vc11\x86\php-5.6.0\main\main.c @ 944] 0170e3b0 6ed88b4c php5!php_error_docref0+0x1b [c:\php-sdk\php56\vc11\x86\php-5.6.0\main\main.c @ 958] 0170e3d8 6ed8ce70 php_mysqli!php_mysqli_throw_sql_exception+0x3c [c:\php-sdk\php56\vc11\x86\php-5.6.0\ext\mysqli\mysqli_exception.c @ 51] 0170e454 6ed86697 php_mysqli!mysqli_common_connect+0xb800 [c:\php-sdk\php56\vc11\x86\php-5.6.0\ext\mysqli\mysqli_nonapi.c @ 250] 0170e46c 0fc638c2 php_mysqli!zif_mysqli_real_connect+0x17 [c:\php-sdk\php56\vc11\x86\php-5.6.0\ext\mysqli\mysqli_api.c @ 1947] 0170e4c0 0fc63093 php5!zend_do_fcall_common_helper_SPEC+0x122 [c:\php-sdk\php56\vc11\x86\php-5.6.0\zend\zend_vm_execute.h @ 558] 0170e4f8 0fc874ee php5!execute_ex+0x2a3 [c:\php-sdk\php56\vc11\x86\php-5.6.0\zend\zend_vm_execute.h @ 363] 0170e51c 0fc8734e php5!zend_execute+0x14e [c:\php-sdk\php56\vc11\x86\php-5.6.0\zend\zend_vm_execute.h @ 388] 0170e550 0fc8894c php5!zend_execute_scripts+0xde [c:\php-sdk\php56\vc11\x86\php-5.6.0\zend\zend.c @ 1330] 0170e74c 00000000 php5!php_execute_script+0x14c [c:\php-sdk\php56\vc11\x86\php-5.6.0\main\main.c @ 2584] -- Edit bug report at https://bugs.php.net/bug.php?id=68754&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68754&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68754&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68754&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68754&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68754&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68754&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68754&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68754&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68754&r=support Expected behavior: https://bugs.php.net/fix.php?id=68754&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68754&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68754&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68754&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68754&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68754&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68754&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68754&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68754&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68754&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68754&r=mysqlcfg