Skip to content

Commit 57f02e2

Browse files
committed
Merge branch 'PHP-8.3'
* PHP-8.3: Fix GH-15432: Heap corruption when querying a vector
2 parents b363a60 + a3dbd39 commit 57f02e2

File tree

3 files changed

+29
-1
lines changed

3 files changed

+29
-1
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ PHP NEWS
1313
. Fixed bug GH-15456 (Crash in get_class_vars() on virtual properties).
1414
(ilutov)
1515

16+
- MySQLnd:
17+
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
18+
Kamil Tekiela)
19+
1620
15 Aug 2024, PHP 8.4.0beta3
1721

1822
- Core:

ext/mysqli/tests/gh15432.phpt

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
Bug GH-15432 (Heap corruption when querying a vector)
3+
--EXTENSIONS--
4+
mysqli
5+
--SKIPIF--
6+
<?php
7+
require 'connect.inc';
8+
$link = @my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
9+
if ($link === false) {
10+
die(sprintf("skip Can't connect to MySQL Server - [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
11+
}
12+
if ($link->server_version < 90000 || $link->server_version >= 10_00_00) {
13+
die("skip MySQL 9.0.0+ needed");
14+
}
15+
?>
16+
--FILE--
17+
<?php
18+
require 'connect.inc';
19+
$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
20+
var_dump($link->query('SELECT STRING_TO_VECTOR("[1.05, -17.8, 32]")'));
21+
?>
22+
--EXPECTF--
23+
Warning: mysqli::query(): Unknown type 242 sent by the server. Please send a report to the developers in %s on line %d
24+
bool(false)

ext/mysqlnd/mysqlnd_result.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s)
300300
if (FAIL == (ret = result->m.read_result_metadata(result, conn))) {
301301
/* For PS, we leave them in Prepared state */
302302
if (!stmt && conn->current_result) {
303-
mnd_efree(conn->current_result);
303+
conn->current_result->m.free_result(conn->current_result, TRUE);
304304
conn->current_result = NULL;
305305
}
306306
DBG_ERR("Error occurred while reading metadata");

0 commit comments

Comments
 (0)