From 7b32b8f4e142dab17d67721f990ec06749db6768 Mon Sep 17 00:00:00 2001
From: Anatol Belski <ab@php.net>
Date: Thu, 5 Nov 2015 21:32:31 +0100
Subject: [PATCH] fix pdo_mysql crash with empty bound stream param

rel #70862
---
 ext/pdo_mysql/mysql_statement.c   |  5 ++--
 ext/pdo_mysql/tests/bug70862.phpt | 46 +++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 2 deletions(-)
 create mode 100644 ext/pdo_mysql/tests/bug70862.phpt

diff --git a/ext/pdo_mysql/mysql_statement.c b/ext/pdo_mysql/mysql_statement.c
index f55843072f222..7c6d3272fd338 100644
--- a/ext/pdo_mysql/mysql_statement.c
+++ b/ext/pdo_mysql/mysql_statement.c
@@ -523,10 +523,11 @@ static int pdo_mysql_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_da
 							parameter = Z_REFVAL(param->parameter);
 						}
 						if (Z_TYPE_P(parameter) == IS_RESOURCE) {
-							php_stream *stm;
+							php_stream *stm = NULL;
 							php_stream_from_zval_no_verify(stm, parameter);
 							if (stm) {
-								ZVAL_STR(parameter, php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0));
+								zend_string *mem = php_stream_copy_to_mem(stm, PHP_STREAM_COPY_ALL, 0);
+								ZVAL_STR(parameter, mem ? mem : STR_EMPTY_ALLOC());
 							} else {
 								pdo_raise_impl_error(stmt->dbh, stmt, "HY105", "Expected a stream resource");
 								return 0;
diff --git a/ext/pdo_mysql/tests/bug70862.phpt b/ext/pdo_mysql/tests/bug70862.phpt
new file mode 100644
index 0000000000000..4a3a618854dbe
--- /dev/null
+++ b/ext/pdo_mysql/tests/bug70862.phpt
@@ -0,0 +1,46 @@
+--TEST--
+MySQL Prepared Statements and BLOBs
+--SKIPIF--
+<?php
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+?>
+--FILE--
+<?php
+	require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+	$db = MySQLPDOTest::factory();
+
+	$db->exec('DROP TABLE IF EXISTS test');
+	$db->exec(sprintf('CREATE TABLE test(id INT, label BLOB)'));
+
+	$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, 0);
+	$db->setAttribute(PDO::ATTR_STRINGIFY_FETCHES, true);
+
+	class HelloWrapper {
+		public function stream_open() { return true; }
+		public function stream_eof() { return true; }
+		public function stream_read() { return NULL; }
+		public function stream_stat() { return array(); }
+	}
+	stream_wrapper_register("hello", "HelloWrapper");
+
+	$f = fopen("hello://there", "r");
+
+	$stmt = $db->prepare('INSERT INTO test(id, label) VALUES (1, :para)');
+	$stmt->bindParam(":para", $f, PDO::PARAM_LOB);
+	$stmt->execute();
+
+	var_dump($f);
+
+	print "done!";
+?>
+--CLEAN--
+<?php
+require dirname(__FILE__) . '/mysql_pdo_test.inc';
+$db = MySQLPDOTest::factory();
+$db->exec('DROP TABLE IF EXISTS test');
+?>
+--EXPECTF--
+string(0) ""
+done!