diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-09-12 21:07:44 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-09-12 21:07:44 -0700 |
| commit | caea2c876b4302b9fb1b12bfa755e064ec199e68 (patch) | |
| tree | 5bfb6843a8cc61460617a4757ef8f0d78d78576c /ext/mysqlnd/mysqlnd_wireprotocol.c | |
| parent | 339a865d87c79c48e72bead1b7a562f3692de1f8 (diff) | |
| download | php-git-caea2c876b4302b9fb1b12bfa755e064ec199e68.tar.gz | |
Fix bug #72293 - Heap overflow in mysqlnd related to BIT fields
Diffstat (limited to 'ext/mysqlnd/mysqlnd_wireprotocol.c')
| -rw-r--r-- | ext/mysqlnd/mysqlnd_wireprotocol.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c index 48b64c19f0..bd0ee2a477 100644 --- a/ext/mysqlnd/mysqlnd_wireprotocol.c +++ b/ext/mysqlnd/mysqlnd_wireprotocol.c @@ -1635,6 +1635,7 @@ php_mysqlnd_rowp_read_text_protocol_aux(MYSQLND_MEMORY_POOL_CHUNK * row_buffer, zend_uchar * p = row_buffer->ptr; size_t data_size = row_buffer->app; zend_uchar * bit_area = (zend_uchar*) row_buffer->ptr + data_size + 1; /* we allocate from here */ + const zend_uchar * const packet_end = (zend_uchar*) row_buffer->ptr + data_size; DBG_ENTER("php_mysqlnd_rowp_read_text_protocol_aux"); @@ -1651,6 +1652,10 @@ php_mysqlnd_rowp_read_text_protocol_aux(MYSQLND_MEMORY_POOL_CHUNK * row_buffer, /* NULL or NOT NULL, this is the question! */ if (len == MYSQLND_NULL_LENGTH) { ZVAL_NULL(current_field); + } else if ((p + len) > packet_end) { + php_error_docref(NULL, E_WARNING, "Malformed server packet. Field length pointing "MYSQLND_SZ_T_SPEC + " bytes after end of packet", (p + len) - packet_end - 1); + DBG_RETURN(FAIL); } else { #if defined(MYSQLND_STRING_TO_INT_CONVERSION) struct st_mysqlnd_perm_bind perm_bind = |