From 224dc52ea99f088597a7f5d1d09ddf68dca9dfb8 Mon Sep 17 00:00:00 2001
From: Rasmus Lerdorf <rasmus@php.net>
Date: Thu, 7 Nov 2013 18:15:15 -0800
Subject: [PATCH 1/4] NEWS entry

---
 NEWS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/NEWS b/NEWS
index c3e70d94a3f..7e426956e50 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2013, PHP 5.4.23
+- PDO
+  . Fixed bug 65946 (sql_parser permanently converts values bound to strings)
 
 ?? ??? 2013, PHP 5.4.22
 

From caab95155d236c0222189aaef6e49c54777257e6 Mon Sep 17 00:00:00 2001
From: Rasmus Lerdorf <rasmus@php.net>
Date: Thu, 7 Nov 2013 18:16:12 -0800
Subject: [PATCH 2/4] NEWS entry

---
 NEWS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/NEWS b/NEWS
index 3a690bbafe6..8c2b651819b 100644
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,7 @@ PHP                                                                        NEWS
 - PDO:
   . Fixed bug #66033 (Segmentation Fault when constructor of PDO statement 
     throws an exception). (Laruence)
+  . Fixed bug 65946 (sql_parser permanently converts values bound to strings)
 
 - Standard:
   . Fixed bug #64760 (var_export() does not use full precision for floating-point

From fd3fa9b53c6bc8f34c1c8bf75141f7ee74dc8db0 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Fri, 8 Nov 2013 15:06:36 +0800
Subject: [PATCH 3/4] Fixed Bug #66043 (Segfault calling bind_param() on
 mysqli)

Although the doc said it is (unsigned int *), but it is ulong* in the
libmysql 5.0 's source codes
---
 NEWS                           |  4 ++++
 ext/mysqli/mysqli_api.c        |  2 +-
 ext/mysqli/tests/bug66043.phpt | 24 ++++++++++++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 ext/mysqli/tests/bug66043.phpt

diff --git a/NEWS b/NEWS
index 7e426956e50..091ae9aa814 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2013, PHP 5.4.23
+
+- MySQLi:
+  . Fixed bug #66043 (Segfault calling bind_param() on mysqli). (Laruence)
+
 - PDO
   . Fixed bug 65946 (sql_parser permanently converts values bound to strings)
 
diff --git a/ext/mysqli/mysqli_api.c b/ext/mysqli/mysqli_api.c
index 2cda0aa903c..6078a5e758d 100644
--- a/ext/mysqli/mysqli_api.c
+++ b/ext/mysqli/mysqli_api.c
@@ -384,7 +384,7 @@ mysqli_stmt_bind_result_do_bind(MY_STMT *stmt, zval ***args, unsigned int argc,
 				/* Changed to my_bool in MySQL 5.1. See MySQL Bug #16144 */
 				my_bool tmp;
 #else
-				uint tmp = 0;
+				ulong tmp = 0;
 #endif
 				stmt->result.buf[ofs].type = IS_STRING;
 				/*
diff --git a/ext/mysqli/tests/bug66043.phpt b/ext/mysqli/tests/bug66043.phpt
new file mode 100644
index 00000000000..d0e8b1c3d39
--- /dev/null
+++ b/ext/mysqli/tests/bug66043.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #66043 (Segfault calling bind_param() on mysqli)
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once("connect.inc");
+if ($IS_MYSQLND) {
+    die("skip libmysql only test");
+}
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+require 'connect.inc';
+$db = new mysqli($host, $user, $passwd, 'mysql');
+
+$stmt = $db->stmt_init();
+$stmt->prepare("SELECT User FROM user WHERE password=\"\"");
+$stmt->execute();
+$stmt->bind_result($testArg);
+echo "Okey";
+?>
+--EXPECTF--
+Okey

From f345152037b72b7d3155e366e6fbe091c228062b Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Fri, 8 Nov 2013 15:08:07 +0800
Subject: [PATCH 4/4] Update NEWS

---
 NEWS | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/NEWS b/NEWS
index 8c2b651819b..02d8b0ec328 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,9 @@ PHP                                                                        NEWS
 - FPM:
   . Changed default listen() backlog to 65535. (Tony)
 
+- MySQLi:
+  . Fixed bug #66043 (Segfault calling bind_param() on mysqli). (Laruence)
+
 - OPcache
   . Increased limit for opcache.max_accelerated_files to 1,000,000. (Chris)