archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 22:18:50 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

MFH: Fixed bug#45019 Segmentation fault with SELECT ? and UNION

Browse source
This commit is contained in:
Andrey Hristov 2008-07-25 12:46:03 +00:00
parent aa81dabddc
commit 7833cf9f10
2 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
ext/mysqli/mysqli_api.c
View file

@ -389,8 +389,13 @@ mysqli_stmt_bind_result_do_bind(MY_STMT *stmt, zval ***args, unsigned int argc,
if (stmt->stmt->fields[ofs].max_length == 0 && if (stmt->stmt->fields[ofs].max_length == 0 &&
!mysql_stmt_attr_get(stmt->stmt, STMT_ATTR_UPDATE_MAX_LENGTH, &tmp) && !tmp) !mysql_stmt_attr_get(stmt->stmt, STMT_ATTR_UPDATE_MAX_LENGTH, &tmp) && !tmp)
{ {
stmt->result.buf[ofs].buflen = /*
(stmt->stmt->fields) ? (stmt->stmt->fields[ofs].length) ? stmt->stmt->fields[ofs].length + 1: 256: 256; Allocate directly 256 because it's easier to allocate a bit more
than update max length even for text columns. Try SELECT UNION SELECT UNION with
different lengths and you will see that we get different lengths in stmt->stmt->fields[ofs].length
The just take 256 and saves us from realloc-ing.
*/
stmt->result.buf[ofs].buflen = 256;
} else { } else {
/* /*
the user has called store_result(). if he does not there is no way to determine the the user has called store_result(). if he does not there is no way to determine the

4
ext/mysqli/tests/bug45019.phpt
View file

@ -57,7 +57,7 @@ require_once('skipifconnectfailure.inc');
printf("[006] [%d] %s\n", $link->errno, $link->error); printf("[006] [%d] %s\n", $link->errno, $link->error);
$column1 = null; $column1 = null;
if (!$stmt->bind_result($column1) || !$stmt->execute()) if (!$stmt->execute() || !$stmt->bind_result($column1))
printf("[007] [%d] %s\n", $stmt->errno, $stmt->error); printf("[007] [%d] %s\n", $stmt->errno, $stmt->error);
$index = 0; $index = 0;
@ -153,6 +153,6 @@ string(5) "three"
string(3) "two" string(3) "two"
Testing bind_param(), strings only, with CAST AS CHAR... Testing bind_param(), strings only, with CAST AS CHAR...
string(3) "one" string(3) "one"
string(5) "three beers are more than enough" string(32) "three beers are more than enough"
string(3) "two" string(3) "two"
done! done!