svn: /php/php-src/ branches/PHP_5_4/ext/mysqli/mysqli_api.c trunk/ext/mysqli/mysqli_api.c
| From: | Xinchen Hui | Date: | Sat, 10 Sep 2011 03:51:16 +0000 |
| Subject: | svn: /php/php-src/ branches/PHP_5_4/ext/mysqli/mysqli_api.c trunk/ext/mysqli/mysqli_api.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-66402@lists.php.net to get a copy of this message | ||
laruence Sat, 10 Sep 2011 03:51:16 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=316474
Log:
Fixed Bug #55653(PS crash with libmysql when binding same variable as param and out)
Actually this caused by attempt to efree a INTERNED string
Bug: https://bugs.php.net/55653 (Open) PS crash with
libmysql when binding same variable as param and out
Changed paths:
U php/php-src/branches/PHP_5_4/ext/mysqli/mysqli_api.c
U php/php-src/trunk/ext/mysqli/mysqli_api.c
Modified: php/php-src/branches/PHP_5_4/ext/mysqli/mysqli_api.c
===================================================================
--- php/php-src/branches/PHP_5_4/ext/mysqli/mysqli_api.c 2011-09-10 01:28:12 UTC (rev 316473)
+++ php/php-src/branches/PHP_5_4/ext/mysqli/mysqli_api.c 2011-09-10 03:51:16 UTC (rev 316474)
@@ -887,7 +887,7 @@
*/
/* Even if the string is of length zero there is one byte alloced so efree() in all cases */
if (Z_TYPE_P(stmt->result.vars[i]) == IS_STRING) {
- efree(stmt->result.vars[i]->value.str.val);
+ STR_FREE(stmt->result.vars[i]->value.str.val);
}
if (!stmt->result.is_null[i]) {
switch (stmt->result.buf[i].type) {
Modified: php/php-src/trunk/ext/mysqli/mysqli_api.c
===================================================================
--- php/php-src/trunk/ext/mysqli/mysqli_api.c 2011-09-10 01:28:12 UTC (rev 316473)
+++ php/php-src/trunk/ext/mysqli/mysqli_api.c 2011-09-10 03:51:16 UTC (rev 316474)
@@ -887,7 +887,7 @@
*/
/* Even if the string is of length zero there is one byte alloced so efree() in all cases */
if (Z_TYPE_P(stmt->result.vars[i]) == IS_STRING) {
- efree(stmt->result.vars[i]->value.str.val);
+ STR_FREE(stmt->result.vars[i]->value.str.val);
}
if (!stmt->result.is_null[i]) {
switch (stmt->result.buf[i].type) {