Skip to content

Commit 7e14d24

Browse files
committed
Fix potential heap corruption due to alignment mismatch
The fix for bug 63327[1] changed the extra size of mysqlnd allocations from `sizeof(size_t)` to the properly aligned values; however, the allocation in `_mysqlnd_pestrdup()` has apparently been overlooked, which (currently) causes detectable heap corruption when running mysqli_get_client_stats.phpt on 32bit Windows versions. [1] <338a47b> Closes GH-9724.
1 parent 577b904 commit 7e14d24

File tree

2 files changed

+3
-2
lines changed

2 files changed

+3
-2
lines changed

NEWS

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.1.13
44

5-
5+
- MySQLnd:
6+
. Fixed potential heap corruption due to alignment mismatch. (cmb)
67

78
27 Oct 2022, PHP 8.1.12
89

ext/mysqlnd/mysqlnd_alloc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,7 @@ static char * _mysqlnd_pestrdup(const char * const ptr, bool persistent MYSQLND_
346346
smart_str_appendc(&tmp_str, *p);
347347
} while (*p++);
348348

349-
ret = pemalloc_rel(ZSTR_LEN(tmp_str.s) + sizeof(size_t), persistent);
349+
ret = pemalloc_rel(REAL_SIZE(ZSTR_LEN(tmp_str.s)), persistent);
350350
memcpy(FAKE_PTR(ret), ZSTR_VAL(tmp_str.s), ZSTR_LEN(tmp_str.s));
351351

352352
if (ret && collect_memory_statistics) {

0 commit comments

Comments
 (0)