Fix GH-11550: MySQL Statement has a empty query result when the response field has changed, also Segmentation fault

ext/mysqli/tests/gh11550.phpt

@@ -0,0 +1,74 @@
+--TEST--
+Bug GH-11550 (MySQL Statement has a empty query result when the response field has changed, also Segmentation fault)
+--EXTENSIONS--
+mysqli
+--SKIPIF--
+<?php
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+require_once("connect.inc");
+
+/*** test mysqli_connect 127.0.0.1 ***/
+$link = new \mysqli($host, $user, $passwd, $db, $port, $socket);
+$link->query(<<<'SQL'
+DROP TABLE IF EXISTS `test`
+SQL);
+$link->query(<<<'SQL'
+CREATE TABLE `test`  (
+    `id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
+    `name` varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+    PRIMARY KEY (`id`) USING BTREE,
+    INDEX `name`(`name`) USING BTREE
+) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_unicode_ci ROW_FORMAT = Dynamic;
+SQL);
+$link->query(<<<'SQL'
+INSERT INTO `test` (`name`) VALUES ('test1');
+SQL);
+
+$link2 = new \mysqli($host, $user, $passwd, $db, $port, $socket);
+$stmt = $link2->prepare('select * from test');
+var_dump('mysqli-1:', $stmt->execute(), $stmt->get_result()->fetch_all());
+
+$link->query(<<<'SQL'
+ALTER TABLE `test`
+ADD COLUMN `a` varchar(255) NOT NULL DEFAULT '';
+SQL);
+
+var_dump('mysqli-2:', $stmt->execute(), $stmt->get_result()->fetch_all());
+echo 'Done';
+?>
+--CLEAN--
+<?php
+require_once("connect.inc");
+
+$link = new \mysqli($host, $user, $passwd, $db, $port, $socket);
+$link->query('DROP TABLE IF EXISTS test_11550');
+?>
+--EXPECT--
+string(9) "mysqli-1:"
+bool(true)
+array(1) {
+  [0]=>
+  array(2) {
+    [0]=>
+    int(1)
+    [1]=>
+    string(5) "test1"
+  }
+}
+string(9) "mysqli-2:"
+bool(true)
+array(1) {
+  [0]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    string(5) "test1"
+    [2]=>
+    string(0) ""
+  }
+}
+Done

ext/mysqlnd/mysqlnd_ps.c

@@ -1315,7 +1315,7 @@ MYSQLND_METHOD(mysqlnd_stmt, bind_one_result)(MYSQLND_STMT * const s, unsigned i
 	MYSQLND_STMT_DATA * stmt = s? s->data : NULL;
 	MYSQLND_CONN_DATA * conn = stmt? stmt->conn : NULL;
 
-	DBG_ENTER("mysqlnd_stmt::bind_result");
+	DBG_ENTER("mysqlnd_stmt::bind_one_result");
 	if (!stmt || !conn) {
 		DBG_RETURN(FAIL);
 	}
@@ -1578,7 +1578,7 @@ MYSQLND_METHOD(mysqlnd_stmt, attr_get)(const MYSQLND_STMT * const s,
 									   void * const value)
 {
 	MYSQLND_STMT_DATA * stmt = s? s->data : NULL;
-	DBG_ENTER("mysqlnd_stmt::attr_set");
+	DBG_ENTER("mysqlnd_stmt::attr_get");
 	if (!stmt) {
 		DBG_RETURN(FAIL);
 	}

ext/mysqlnd/mysqlnd_result.c

@@ -286,6 +286,10 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s)
 						  COM_STMT_EXECUTE (even if it is not necessary), so either this or
 						  previous branch always works.
 						*/
+						if (rset_header.field_count != stmt->result->field_count) {
+							stmt->result->m.free_result(stmt->result, TRUE);
+							stmt->result = conn->m->result_init(rset_header.field_count);
+						}
 					}
 					result = stmt->result;
 				}

ext/mysqlnd/mysqlnd_result_meta.c

@@ -259,7 +259,7 @@ static MYSQLND_FIELD_OFFSET
 MYSQLND_METHOD(mysqlnd_res_meta, field_seek)(MYSQLND_RES_METADATA * const meta, const MYSQLND_FIELD_OFFSET field_offset)
 {
 	MYSQLND_FIELD_OFFSET return_value = 0;
-	DBG_ENTER("mysqlnd_res_meta::fetch_fields");
+	DBG_ENTER("mysqlnd_res_meta::field_seek");
 	return_value = meta->current_field;
 	meta->current_field = field_offset;
 	DBG_RETURN(return_value);

ext/pdo_mysql/mysql_driver.c

@@ -355,7 +355,7 @@ static bool mysql_handle_begin(pdo_dbh_t *dbh)
 	zend_long return_value;
 	zend_string *command;
 
-	PDO_DBG_ENTER("mysql_handle_quoter");
+	PDO_DBG_ENTER("mysql_handle_begin");
 	PDO_DBG_INF_FMT("dbh=%p", dbh);
 
 	command = zend_string_init("START TRANSACTION", strlen("START TRANSACTION"), 0);

ext/pdo_mysql/tests/gh11550.phpt

@@ -0,0 +1,86 @@
+--TEST--
+Bug GH-11550 (MySQL Statement has a empty query result when the response field has changed, also Segmentation fault)
+--EXTENSIONS--
+pdo
+pdo_mysql
+--SKIPIF--
+<?php
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+?>
+--FILE--
+<?php
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+$pdo = MySQLPDOTest::factory();
+$pdo->exec(<<<'SQL'
+DROP TABLE IF EXISTS `test`
+SQL);
+$pdo->exec(<<<'SQL'
+CREATE TABLE `test`  (
+  `id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
+  `name` varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  PRIMARY KEY (`id`) USING BTREE,
+  INDEX `name`(`name`) USING BTREE
+) ENGINE = InnoDB CHARACTER SET = utf8mb4 COLLATE = utf8mb4_unicode_ci ROW_FORMAT = Dynamic;
+SQL);
+$pdo->exec(<<<'SQL'
+INSERT INTO `test` (`name`) VALUES ('test1');
+SQL);
+
+$pdo2 = MySQLPDOTest::factory();
+$pdo2->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
+$stmt = $pdo2->prepare('select * from test');
+var_dump('PDO-1:', $stmt->execute(), $stmt->fetchAll());
+
+$stmt->closeCursor(); // Optional. Segmentation fault (core dumped)
+
+$pdo->exec(<<<'SQL'
+ALTER TABLE `test`
+ADD COLUMN `a` varchar(255) NOT NULL DEFAULT '';
+SQL);
+
+var_dump('PDO-2:', $stmt->execute(), $stmt->fetchAll());
+echo 'Done';
+?>
+--CLEAN--
+<?php
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+$pdo = MySQLPDOTest::factory();
+$pdo->query('DROP TABLE IF EXISTS test_11550');
+?>
+--EXPECT--
+string(6) "PDO-1:"
+bool(true)
+array(1) {
+  [0]=>
+  array(4) {
+    ["id"]=>
+    int(1)
+    [0]=>
+    int(1)
+    ["name"]=>
+    string(5) "test1"
+    [1]=>
+    string(5) "test1"
+  }
+}
+string(6) "PDO-2:"
+bool(true)
+array(1) {
+  [0]=>
+  array(6) {
+    ["id"]=>
+    int(1)
+    [0]=>
+    int(1)
+    ["name"]=>
+    string(5) "test1"
+    [1]=>
+    string(5) "test1"
+    ["a"]=>
+    string(0) ""
+    [2]=>
+    string(0) ""
+  }
+}
+Done