5.4.25 RC1

There are situations where mysqlnd dupliates zvals while freeing result
sets. If the memory_limit is reached during this operation the engine
will bailout. This patch makes sure that a later attempt (during
RSHIUTDOWN) won't cause a double free, instead we rely on the engine to
free emalloc()ed memory after bailout.

NEWS

@@ -1,19 +1,24 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2013, PHP 5.4.25
+23 Jan 2013, PHP 5.4.25 RC1
 
 - Core:
   . Fixed bug #66286 (Incorrect object comparison with inheritance). (Nikita)
-  . Fixed bug #66509 (copy() arginfo has changed starting from 5.4). (willfitch)
+  . Fixed bug #66509 (copy() arginfo has changed starting from 5.4). 
+    (Will Fitch)
+
+- mysqlnd
+  . Fixed bug #66283 (Segmentation fault after memory_limit). (Johannes)
 
 - PDO_pgsql:
-  . Fixed bug #62479 (PDO-psql cannot connect if password contains spaces) (willfitch, iliaa)
+  . Fixed bug #62479 (PDO-psql cannot connect if password contains spaces).
+    (Will Fitch, Ilia)
 
 - Session:
   . Fixed bug #66481 (Calls to session_name() segfault when session.name is
     null). (Laruence)
 
-?? ??? 2013, PHP 5.4.24
+10 Jan 2013, PHP 5.4.24
 
 - Core:
   . Added validation of class names in the autoload process. (Dmitry)

configure.in

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
 PHP_RELEASE_VERSION=25
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION="RC1"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/libxml/libxml.c

@@ -87,7 +87,7 @@ static PHP_MINIT_FUNCTION(libxml);
 static PHP_RINIT_FUNCTION(libxml);
 static PHP_MSHUTDOWN_FUNCTION(libxml);
 static PHP_MINFO_FUNCTION(libxml);
-static int php_libxml_post_deactivate();
+static int php_libxml_post_deactivate(void);
 
 /* }}} */
 
@@ -869,7 +869,7 @@ static PHP_MSHUTDOWN_FUNCTION(libxml)
 	return SUCCESS;
 }
 
-static int php_libxml_post_deactivate()
+static int php_libxml_post_deactivate(void)
 {
 	TSRMLS_FETCH();
 	/* reset libxml generic error handling */

ext/mysqlnd/mysqlnd_result.c

@@ -198,9 +198,11 @@ MYSQLND_METHOD(mysqlnd_res, free_buffered_data)(MYSQLND_RES * result TSRMLS_DC)
 	if (set->data) {
 		unsigned int copy_on_write_performed = 0;
 		unsigned int copy_on_write_saved = 0;
+		zval **data = set->data;
+		set->data = NULL; /* prevent double free if following loop is interrupted */
 
 		for (row = set->row_count - 1; row >= 0; row--) {
-			zval **current_row = set->data + row * field_count;
+			zval **current_row = data + row * field_count;
 			MYSQLND_MEMORY_POOL_CHUNK *current_buffer = set->row_buffers[row];
 			int64_t col;
 
@@ -222,8 +224,7 @@ MYSQLND_METHOD(mysqlnd_res, free_buffered_data)(MYSQLND_RES * result TSRMLS_DC)
 
 		MYSQLND_INC_GLOBAL_STATISTIC_W_VALUE2(STAT_COPY_ON_WRITE_PERFORMED, copy_on_write_performed,
 											  STAT_COPY_ON_WRITE_SAVED, copy_on_write_saved);
-		mnd_efree(set->data);
-		set->data = NULL;
+		mnd_efree(data);
 	}
 
 	if (set->row_buffers) {

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 4
 #define PHP_RELEASE_VERSION 25
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.25-dev"
+#define PHP_EXTRA_VERSION "RC1"
+#define PHP_VERSION "5.4.25RC1"
 #define PHP_VERSION_ID 50425