[php-src] Issue #7967: Segmentation fault in mysqli_stmt::bind_result with libmysql configuration
| From: | mdsnins | Date: | Wed, 19 Jan 2022 06:42:23 +0000 |
| Subject: | [php-src] Issue #7967: Segmentation fault in mysqli_stmt::bind_result with libmysql configuration | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-239116@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/7967
Author: mdsnins
### Description
The following code:
```php
<?php
$mysqli = new mysqli("localhost", "test", "test"); // either mysql or
mariadb
$stmt = $mysqli->prepare("select 1");
$mysqli->close();
$stmt->bind_result($a);
```
Resulted in this output:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==9010==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000408 (pc 0x7f04d791c74c bp
0x7ffc2f1a3710 sp 0x7ffc2f1a36d0 T0)
==9010==The signal is caused by a READ memory access.
==9010==Hint: address points to the zero page.
#0 0x7f04d791c74b in mysql_stmt_bind_result
(/usr/lib/x86_64-linux-gnu/libmysqlclient.so.21+0x2f74b)
#1 0x55a3f200bd3e in mysqli_stmt_bind_result_do_bind
/home/payload/php-src/ext/mysqli/mysqli_api.c:501
#2 0x55a3f200c876 in zif_mysqli_stmt_bind_result
/home/payload/php-src/ext/mysqli/mysqli_api.c:561
#3 0x55a3f2ba4899 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER
/home/payload/php-src/Zend/zend_vm_execute.h:1776
#4 0x55a3f2ba4899 in execute_ex /home/payload/php-src/Zend/zend_vm_execute.h:55441
#5 0x55a3f2bf0e8f in zend_execute /home/payload/php-src/Zend/zend_vm_execute.h:59760
#6 0x55a3f27f47c9 in zend_execute_scripts /home/payload/php-src/Zend/zend.c:1744
#7 0x55a3f261dfb8 in php_execute_script /home/payload/php-src/main/main.c:2535
#8 0x55a3f2eb85e4 in do_cli /home/payload/php-src/sapi/cli/php_cli.c:965
#9 0x55a3f2ebb170 in main /home/payload/php-src/sapi/cli/php_cli.c:1367
#10 0x7f04d75b80b2 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#11 0x55a3f1c032dd in _start (/home/payload/php82_libmysql/bin/php+0x4032dd)
```
But I expected this output instead:
```
Fatal error: Uncaught mysqli_sql_exception: Lost connection to MySQL server during query in
```
as other mysqli functions
### PHP Version
PHP 8.2.0-dev
### Operating System
Ubuntu 20.04 (WSL)