From c2a61bdebcaffb6487db1a0932e032db25d9f17a Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 11 Oct 2022 17:14:39 +0200 Subject: [PATCH] Fix potential heap corruption due to alignment mismatch The fix for bug 63327[1] changed the extra size of mysqlnd allocations from `sizeof(size_t)` to the properly aligned values; however, the allocation in `_mysqlnd_pestrdup()` has apparently been overlooked, which (currently) causes detectable heap corruption when running mysqli_get_client_stats.phpt on 32bit Windows versions. [1] --- ext/mysqlnd/mysqlnd_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/mysqlnd/mysqlnd_alloc.c b/ext/mysqlnd/mysqlnd_alloc.c index fbf3bd276cc7..dd11483b685b 100644 --- a/ext/mysqlnd/mysqlnd_alloc.c +++ b/ext/mysqlnd/mysqlnd_alloc.c @@ -346,7 +346,7 @@ static char * _mysqlnd_pestrdup(const char * const ptr, bool persistent MYSQLND_ smart_str_appendc(&tmp_str, *p); } while (*p++); - ret = pemalloc_rel(ZSTR_LEN(tmp_str.s) + sizeof(size_t), persistent); + ret = pemalloc_rel(REAL_SIZE(ZSTR_LEN(tmp_str.s)), persistent); memcpy(FAKE_PTR(ret), ZSTR_VAL(tmp_str.s), ZSTR_LEN(tmp_str.s)); if (ret && collect_memory_statistics) {