Merge branch 'PHP-8.4' into PHP-8.5

Author: kamil-tekiela

NEWS

@@ -72,6 +72,8 @@ PHP                                                                        NEWS
 
 - MySQLnd:
   . Fixed field_count not resetting on OK packet. (Kamil Tekiela)
+  . Fixed memory leak when closing a prepared statement after its connection
+    was killed. (Kamil Tekiela)
 
 - Opcache:
   . Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with

ext/mysqli/mysqli.c

@@ -115,7 +115,6 @@ void php_clear_stmt_bind(MY_STMT *stmt)
 	if (stmt->stmt) {
 		if (mysqli_stmt_close(stmt->stmt, true)) {
 			php_error_docref(NULL, E_WARNING, "Error occurred while closing statement");
-			return;
 		}
 	}
 

ext/mysqli/tests/mysqli_stmt_close_killed_connection.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Closing a prepared statement after its connection was killed must not leak
+--EXTENSIONS--
+mysqli
+--SKIPIF--
+<?php
+require_once 'skipifconnectfailure.inc';
+?>
+--FILE--
+<?php
+require_once 'connect.inc';
+
+mysqli_report(MYSQLI_REPORT_OFF);
+$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
+
+$stmts = [];
+for ($i = 0; $i < 20; $i++) {
+    $stmts[] = $link->prepare('DO 1');
+}
+$link->query('KILL ' . $link->thread_id);
+
+// Over TCP, a few COM_STMT_CLOSE writes may be accepted before one fails
+do {
+    array_pop($stmts);
+    usleep(1000);
+} while ($stmts && !$link->errno);
+
+echo "done!\n";
+?>
+--EXPECTF--
+Warning: main(): Error occurred while closing statement in %s on line %d
+done!

ext/mysqlnd/mysqlnd_ps.c

@@ -1758,6 +1758,7 @@ MYSQLND_METHOD_PRIVATE(mysqlnd_stmt, close_on_server)(MYSQLND_STMT * const s, bo
 	MYSQLND_STMT_DATA * stmt = s? s->data : NULL;
 	MYSQLND_CONN_DATA * conn = stmt? stmt->conn : NULL;
 	enum_mysqlnd_collected_stats statistic = STAT_LAST;
+	enum_func_status ret = PASS;
 
 	DBG_ENTER("mysqlnd_stmt::close_on_server");
 	if (!stmt || !conn) {
@@ -1795,14 +1796,7 @@ MYSQLND_METHOD_PRIVATE(mysqlnd_stmt, close_on_server)(MYSQLND_STMT * const s, bo
 														STAT_FREE_RESULT_EXPLICIT);
 
 		if (GET_CONNECTION_STATE(&conn->state) == CONN_READY) {
-			enum_func_status ret = FAIL;
-			const size_t stmt_id = stmt->stmt_id;
-
-			ret = conn->command->stmt_close(conn, stmt_id);
-			if (ret == FAIL) {
-				COPY_CLIENT_ERROR(stmt->error_info, *conn->error_info);
-				DBG_RETURN(FAIL);
-			}
+			ret = conn->command->stmt_close(conn, stmt->stmt_id);
 		}
 	}
 	switch (stmt->execute_count) {
@@ -1831,7 +1825,7 @@ MYSQLND_METHOD_PRIVATE(mysqlnd_stmt, close_on_server)(MYSQLND_STMT * const s, bo
 		stmt->conn = NULL;
 	}
 
-	DBG_RETURN(PASS);
+	DBG_RETURN(ret);
 }
 /* }}} */