com php-src: Fix bug #66283 (Segmentation fault after memory_limit): NEWS ext/mysqlnd/mysqlnd_result.c

Commit: 2311ba7d3ff08d27bd7d4b87b51a0f96c5d62d12 Author: Johannes Schlüter <johannes@php.net> Tue, 21 Jan 2014 16:28:30 +0100 Parents: 2bd68bf03940769cbd59e5876935147291fd4017 Branches: PHP-5.4 PHP-5.5 PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2311ba7d3ff08d27bd7d4b87b51a0f96c5d62d12 Log: Fix bug #66283 (Segmentation fault after memory_limit) There are situations where mysqlnd dupliates zvals while freeing result sets. If the memory_limit is reached during this operation the engine will bailout. This patch makes sure that a later attempt (during RSHIUTDOWN) won't cause a double free, instead we rely on the engine to free emalloc()ed memory after bailout. Bugs: https://bugs.php.net/66283 Changed paths: M NEWS M ext/mysqlnd/mysqlnd_result.c Diff: diff --git a/NEWS b/NEWS index f542bcf..7715e2a 100644 --- a/NEWS +++ b/NEWS @@ -6,6 +6,9 @@ PHP NEWS . Fixed bug #66286 (Incorrect object comparison with inheritance). (Nikita) . Fixed bug #66509 (copy() arginfo has changed starting from 5.4). (willfitch) +- mysqlnd + . Fixed bug #66283 (Segmentation fault after memory_limit). (Johannes) + - PDO_pgsql: . Fixed bug #62479 (PDO-psql cannot connect if password contains spaces) (willfitch, iliaa) diff --git a/ext/mysqlnd/mysqlnd_result.c b/ext/mysqlnd/mysqlnd_result.c index cb15657..0814926 100644 --- a/ext/mysqlnd/mysqlnd_result.c +++ b/ext/mysqlnd/mysqlnd_result.c @@ -198,9 +198,11 @@ MYSQLND_METHOD(mysqlnd_res, free_buffered_data)(MYSQLND_RES * result TSRMLS_DC) if (set->data) { unsigned int copy_on_write_performed = 0; unsigned int copy_on_write_saved = 0; + zval **data = set->data; + set->data = NULL; /* prevent double free if following loop is interrupted */ for (row = set->row_count - 1; row >= 0; row--) { - zval **current_row = set->data + row * field_count; + zval **current_row = data + row * field_count; MYSQLND_MEMORY_POOL_CHUNK *current_buffer = set->row_buffers[row]; int64_t col; @@ -222,8 +224,7 @@ MYSQLND_METHOD(mysqlnd_res, free_buffered_data)(MYSQLND_RES * result TSRMLS_DC) MYSQLND_INC_GLOBAL_STATISTIC_W_VALUE2(STAT_COPY_ON_WRITE_PERFORMED, copy_on_write_performed, STAT_COPY_ON_WRITE_SAVED, copy_on_write_saved); - mnd_efree(set->data); - set->data = NULL; + mnd_efree(data); } if (set->row_buffers) {