diff --git a/ext/mysqli/tests/gh15432.phpt b/ext/mysqli/tests/gh15432.phpt new file mode 100644 index 0000000000000..50372a1bbc544 --- /dev/null +++ b/ext/mysqli/tests/gh15432.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug GH-15432 (Heap corruption when querying a vector) +--EXTENSIONS-- +mysqli +--SKIPIF-- +server_version < 90000 || $link->server_version >= 10_00_00) { + die("skip MySQL 9.0.0+ needed"); +} +?> +--FILE-- +query('SELECT STRING_TO_VECTOR("[1.05, -17.8, 32]")')); +?> +--EXPECTF-- +Warning: mysqli::query(): Unknown type 242 sent by the server. Please send a report to the developers in %s on line %d +bool(false) diff --git a/ext/mysqlnd/mysqlnd_result.c b/ext/mysqlnd/mysqlnd_result.c index cf091a802bb66..43983279e7705 100644 --- a/ext/mysqlnd/mysqlnd_result.c +++ b/ext/mysqlnd/mysqlnd_result.c @@ -302,7 +302,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s) if (FAIL == (ret = result->m.read_result_metadata(result, conn))) { /* For PS, we leave them in Prepared state */ if (!stmt && conn->current_result) { - mnd_efree(conn->current_result); + conn->current_result->m.free_result(conn->current_result, TRUE); conn->current_result = NULL; } DBG_ERR("Error occurred while reading metadata");