diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-07-05 00:00:53 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-07-07 10:16:54 -0700 |
| commit | d8aa5675ad2ead0469c15fad167ecbdd60051716 (patch) | |
| tree | 9c1e63008427ddf58024d56191c83d05e4dfa602 /ext/mysqlnd/mysqlnd.c | |
| parent | 12ff95574bb1303fc03695a1721a8b4529d1ed0a (diff) | |
| download | php-git-d8aa5675ad2ead0469c15fad167ecbdd60051716.tar.gz | |
Fix bug #69669 (mysqlnd is vulnerable to BACKRONYM)
Diffstat (limited to 'ext/mysqlnd/mysqlnd.c')
| -rw-r--r-- | ext/mysqlnd/mysqlnd.c | 38 |
1 files changed, 26 insertions, 12 deletions
diff --git a/ext/mysqlnd/mysqlnd.c b/ext/mysqlnd/mysqlnd.c index 0a81d0bb96..7595474475 100644 --- a/ext/mysqlnd/mysqlnd.c +++ b/ext/mysqlnd/mysqlnd.c @@ -487,27 +487,41 @@ mysqlnd_switch_to_ssl_if_needed( } #ifdef MYSQLND_SSL_SUPPORTED - if ((greet_packet->server_capabilities & CLIENT_SSL) && (mysql_flags & CLIENT_SSL)) { - zend_bool verify = mysql_flags & CLIENT_SSL_VERIFY_SERVER_CERT? TRUE:FALSE; - DBG_INF("Switching to SSL"); - if (!PACKET_WRITE(auth_packet, conn)) { - CONN_SET_STATE(conn, CONN_QUIT_SENT); - conn->m->send_close(conn); - SET_CLIENT_ERROR(*conn->error_info, CR_SERVER_GONE_ERROR, UNKNOWN_SQLSTATE, mysqlnd_server_gone); - goto end; - } + if (mysql_flags & CLIENT_SSL) { + zend_bool server_has_ssl = (greet_packet->server_capabilities & CLIENT_SSL)? TRUE:FALSE; + if (server_has_ssl == FALSE) { + goto close_conn; + } else { + zend_bool verify = mysql_flags & CLIENT_SSL_VERIFY_SERVER_CERT? TRUE:FALSE; + DBG_INF("Switching to SSL"); + if (!PACKET_WRITE(auth_packet, conn)) { + goto close_conn; + } - conn->net->data->m.set_client_option(conn->net, MYSQL_OPT_SSL_VERIFY_SERVER_CERT, (const char *) &verify); + conn->net->data->m.set_client_option(conn->net, MYSQL_OPT_SSL_VERIFY_SERVER_CERT, (const char *) &verify); - if (FAIL == conn->net->data->m.enable_ssl(conn->net)) { - goto end; + if (FAIL == conn->net->data->m.enable_ssl(conn->net)) { + goto end; + } } } +#else + auth_packet->client_flags &= ~CLIENT_SSL; + if (!PACKET_WRITE(auth_packet, conn)) { + goto close_conn; + } #endif ret = PASS; end: PACKET_FREE(auth_packet); DBG_RETURN(ret); + +close_conn: + CONN_SET_STATE(conn, CONN_QUIT_SENT); + conn->m->send_close(conn TSRMLS_CC); + SET_CLIENT_ERROR(*conn->error_info, CR_SERVER_GONE_ERROR, UNKNOWN_SQLSTATE, mysqlnd_server_gone); + PACKET_FREE(auth_packet); + DBG_RETURN(ret); } /* }}} */ |