Bug #72413 [Asn->Csd]: mysqlnd segfault (fetch_row second parameter typemismatch)

Edit report at https://bugs.php.net/bug.php?id=72413&edit=1 ID: 72413 Updated by: nikic@php.net Reported by: martin dot koegler at brz dot gv dot at Summary: mysqlnd segfault (fetch_row second parameter typemismatch) -Status: Assigned +Status: Closed Type: Bug Package: *General Issues Operating System: Linux PHP Version: 5.6.22 Assigned To: mysql Block user comment: N Private report: N New Comment: Automatic comment on behalf of tekiela246@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=b5481defe64c991d0e4307372d69c0ea3cd83378 Log: Fix bug #72413: Segfault with get_result and PS cursors Previous Comments: ------------------------------------------------------------------------ [2019-08-08 07:01:49] cmb@php.net Related To: Bug #73210 ------------------------------------------------------------------------ [2016-06-15 14:47:49] martin dot koegler at brz dot gv dot at Description: ------------ If the MYSQLI_CURSOR_TYPE_READ_ONLY option is active on a mysqli statement, mysqlnd_fetch_stmt_row_cursor is selected as row fetch method. mysqlnd_fetch_stmt_row_cursor expects a MYSQLND_STMT passed as "param" parameter. mysqlnd_res::fetch_into passes a zval as this parameter, which yields to a crash. Test script: --------------- <?php $link1=mysqli_connect(....); $SQL="SELECT 1"; $stmt=$link1->prepare($SQL); $stmt->attr_set(MYSQLI_STMT_ATTR_CURSOR_TYPE, MYSQLI_CURSOR_TYPE_READ_ONLY); $stmt->execute(); $res = $stmt->get_result(); while($res->fetch_row()); ?> Expected result: ---------------- No segfault Actual result: -------------- Segfault in 1022 SET_CLIENT_ERROR(*stmt->conn->error_info, CR_COMMANDS_OUT_OF_SYNC, UNKNOWN_SQLSTATE, mysqlnd_fetch_stmt_row_cursor at ext/mysqlnd/mysqlnd_ps.c:1022 php_mysqlnd_res_fetch_into_pub at ext/mysqlnd/mysqlnd_result.c:1823 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72413&edit=1