Handle OOM in block_alloc_get_chunk, and also in the caller

in mysqlnd_wireprotocol.c

Author: faizshukri

ext/mysqlnd/mysqlnd_block_alloc.c

@@ -119,29 +119,30 @@ MYSQLND_MEMORY_POOL_CHUNK * mysqlnd_mempool_get_chunk(MYSQLND_MEMORY_POOL * pool
 	DBG_ENTER("mysqlnd_mempool_get_chunk");
 
 	chunk = mnd_malloc(sizeof(MYSQLND_MEMORY_POOL_CHUNK));
-
-	chunk->free_chunk = mysqlnd_mempool_free_chunk;
-	chunk->resize_chunk = mysqlnd_mempool_resize_chunk;
-	chunk->size = size;
-	/*
-	  Should not go over MYSQLND_MAX_PACKET_SIZE, since we
-	  expect non-arena memory in mysqlnd_wireprotocol.c . We
-	  realloc the non-arena memory.
-	*/
-	chunk->pool = pool;
-	if (size > pool->free_size) {
-		chunk->from_pool = FALSE;
-		chunk->ptr = mnd_malloc(size);
-		if (!chunk->ptr) {
-			chunk->free_chunk(chunk TSRMLS_CC);
-			chunk = NULL;
+	if (chunk) {
+		chunk->free_chunk = mysqlnd_mempool_free_chunk;
+		chunk->resize_chunk = mysqlnd_mempool_resize_chunk;
+		chunk->size = size;
+		/*
+		  Should not go over MYSQLND_MAX_PACKET_SIZE, since we
+		  expect non-arena memory in mysqlnd_wireprotocol.c . We
+		  realloc the non-arena memory.
+		*/
+		chunk->pool = pool;
+		if (size > pool->free_size) {
+			chunk->from_pool = FALSE;
+			chunk->ptr = mnd_malloc(size);
+			if (!chunk->ptr) {
+				chunk->free_chunk(chunk TSRMLS_CC);
+				chunk = NULL;
+			}
+		} else {
+			chunk->from_pool = TRUE;
+			++pool->refcount;
+			chunk->ptr = pool->arena + (pool->arena_size - pool->free_size);
+			/* Last step, update free_size */
+			pool->free_size -= size;
 		}
-	} else {
-		chunk->from_pool = TRUE;
-		++pool->refcount;
-		chunk->ptr = pool->arena + (pool->arena_size - pool->free_size);
-		/* Last step, update free_size */
-		pool->free_size -= size;
 	}
 	DBG_RETURN(chunk);
 }

ext/mysqlnd/mysqlnd_wireprotocol.c

@@ -1136,6 +1136,10 @@ php_mysqlnd_read_row_ex(MYSQLND * conn, MYSQLND_MEMORY_POOL * result_set_memory_
 			  to be able to implement read-only variables. Thus, we add + 1.
 			*/
 			*buffer = result_set_memory_pool->get_chunk(result_set_memory_pool, *data_size + 1 TSRMLS_CC);
+			if (!*buffer) {
+				ret = FAIL;
+				break;
+			}
 			p = (*buffer)->ptr;
 		} else if (!first_iteration) {
 			/* Empty packet after MYSQLND_MAX_PACKET_SIZE packet. That's ok, break */