Please sign in to comment.
Fix use-after-free for repeated fetchrow_arrayref calls when mysql_se…
…rver_prepare=1 Function dbd_st_fetch() via Renew() can reallocate output buffer for mysql_stmt_fetch() call. But it does not update pointer to that buffer in imp_sth->stmt structure initialized by mysql_stmt_bind_result() function. That leads to use-after-free in any mysql function which access imp_sth->stmt structure (e.g. mysql_stmt_fetch()). This patch fix this problem and properly updates pointer in imp_sth->stmt structure after Renew() call. Test 40server_prepare_crash.t is extended to check for that use-after-free crash.
- Loading branch information...
Showing with 44 additions and 3 deletions.