archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.2' into PHP-8.3

Browse source 
* PHP-8.2:
  Fix GH-15432: Heap corruption when querying a vector
This commit is contained in:
Christoph M. Becker 2024-08-20 15:43:55 +02:00
commit a3dbd39be0
No known key found for this signature in database
GPG key ID: D66C9593118BCCB6
3 changed files with 31 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
NEWS
View file

@ -2,6 +2,12 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP-8.3.12
- MySQLnd:
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
Kamil Tekiela)
29 Aug 2024, PHP-8.3.12
- Core:
. Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
(zeriyoshi)

24
ext/mysqli/tests/gh15432.phpt Normal file
View file

@ -0,0 +1,24 @@
--TEST--
Bug GH-15432 (Heap corruption when querying a vector)
--EXTENSIONS--
mysqli
--SKIPIF--
<?php
require 'connect.inc';
$link = @my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
if ($link === false) {
die(sprintf("skip Can't connect to MySQL Server - [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
}
if ($link->server_version < 90000 || $link->server_version >= 10_00_00) {
die("skip MySQL 9.0.0+ needed");
}
?>
--FILE--
<?php
require 'connect.inc';
$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
var_dump($link->query('SELECT STRING_TO_VECTOR("[1.05, -17.8, 32]")'));
?>
--EXPECTF--
Warning: mysqli::query(): Unknown type 242 sent by the server. Please send a report to the developers in %s on line %d
bool(false)

2
ext/mysqlnd/mysqlnd_result.c
View file

@ -300,7 +300,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s)
if (FAIL == (ret = result->m.read_result_metadata(result, conn))) {
/* For PS, we leave them in Prepared state */
if (!stmt && conn->current_result) {
mnd_efree(conn->current_result);
conn->current_result->m.free_result(conn->current_result, TRUE);
conn->current_result = NULL;
}
DBG_ERR("Error occurred while reading metadata");