Skip to content

Commit a3dbd39

Browse files
committed
Merge branch 'PHP-8.2' into PHP-8.3
* PHP-8.2: Fix GH-15432: Heap corruption when querying a vector
2 parents 093aee6 + b1211c1 commit a3dbd39

File tree

3 files changed

+31
-1
lines changed

3 files changed

+31
-1
lines changed

NEWS

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP-8.3.12
44

5+
- MySQLnd:
6+
. Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb,
7+
Kamil Tekiela)
8+
9+
29 Aug 2024, PHP-8.3.12
10+
511
- Core:
612
. Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
713
(zeriyoshi)

ext/mysqli/tests/gh15432.phpt

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
Bug GH-15432 (Heap corruption when querying a vector)
3+
--EXTENSIONS--
4+
mysqli
5+
--SKIPIF--
6+
<?php
7+
require 'connect.inc';
8+
$link = @my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
9+
if ($link === false) {
10+
die(sprintf("skip Can't connect to MySQL Server - [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
11+
}
12+
if ($link->server_version < 90000 || $link->server_version >= 10_00_00) {
13+
die("skip MySQL 9.0.0+ needed");
14+
}
15+
?>
16+
--FILE--
17+
<?php
18+
require 'connect.inc';
19+
$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
20+
var_dump($link->query('SELECT STRING_TO_VECTOR("[1.05, -17.8, 32]")'));
21+
?>
22+
--EXPECTF--
23+
Warning: mysqli::query(): Unknown type 242 sent by the server. Please send a report to the developers in %s on line %d
24+
bool(false)

ext/mysqlnd/mysqlnd_result.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s)
300300
if (FAIL == (ret = result->m.read_result_metadata(result, conn))) {
301301
/* For PS, we leave them in Prepared state */
302302
if (!stmt && conn->current_result) {
303-
mnd_efree(conn->current_result);
303+
conn->current_result->m.free_result(conn->current_result, TRUE);
304304
conn->current_result = NULL;
305305
}
306306
DBG_ERR("Error occurred while reading metadata");

0 commit comments

Comments
 (0)