archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-15432: Heap corruption when querying a vector

Browse source 
Since the mysqlnd result set is arena allocated, we must not simply
free it, but rather call the appropriate `free_result` method.

Co-authored-by: Kamil Tekiela <tekiela246@gmail.com>
This commit is contained in:
Christoph M. Becker 2024-08-16 21:01:56 +02:00
parent 836e6fa900
commit b1211c1e4a
No known key found for this signature in database
GPG key ID: D66C9593118BCCB6
3 changed files with 29 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
NEWS
View file

@ -2,6 +2,10 @@ PHP NEWS
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.2.24 ?? ??? ????, PHP 8.2.24
- MySQLnd:
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
Kamil Tekiela)
29 Aug 2024, PHP 8.2.23 29 Aug 2024, PHP 8.2.23
- Core: - Core:

24
ext/mysqli/tests/gh15432.phpt Normal file
View file

@ -0,0 +1,24 @@
--TEST--
Bug GH-15432 (Heap corruption when querying a vector)
--EXTENSIONS--
mysqli
--SKIPIF--
<?php
require 'connect.inc';
$link = @my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
if ($link === false) {
die(sprintf("skip Can't connect to MySQL Server - [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
}
if ($link->server_version < 90000 || $link->server_version >= 10_00_00) {
die("skip MySQL 9.0.0+ needed");
}
?>
--FILE--
<?php
require 'connect.inc';
$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
var_dump($link->query('SELECT STRING_TO_VECTOR("[1.05, -17.8, 32]")'));
?>
--EXPECTF--
Warning: mysqli::query(): Unknown type 242 sent by the server. Please send a report to the developers in %s on line %d
bool(false)

2
ext/mysqlnd/mysqlnd_result.c
View file

@ -302,7 +302,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s)
if (FAIL == (ret = result->m.read_result_metadata(result, conn))) { if (FAIL == (ret = result->m.read_result_metadata(result, conn))) {
/* For PS, we leave them in Prepared state */ /* For PS, we leave them in Prepared state */
if (!stmt && conn->current_result) { if (!stmt && conn->current_result) {
mnd_efree(conn->current_result); conn->current_result->m.free_result(conn->current_result, TRUE);
conn->current_result = NULL; conn->current_result = NULL;
} }
DBG_ERR("Error occurred while reading metadata"); DBG_ERR("Error occurred while reading metadata");