Fixed segfault in mysqlnd when doing long prepare

php · Jul 8, 2013 · 9fc3818 · 9fc3818 · csdougliss · Apr 7, 2014
1 parent b34e8d2
commit 9fc3818
Show file tree

Hide file tree

Showing 3 changed files with 54 additions and 0 deletions.
diff --git a/NEWS b/NEWS
@@ -21,6 +21,9 @@ PHP                                                                        NEWS
 
 - Intl: 
   . Fixed bug #62759: Buggy grapheme_substr() on edge case. (Stas)
+
+- mysqlnd: 
+  . Fixed segfault in mysqlnd when doing long prepare. (Andrey)
 
 - ODBC:
   . Fixed bug #61387 (NULL valued anonymous column causes segfault in 

diff --git a/ext/mysqli/tests/mysqli_stmt_big_prepare.phpt b/ext/mysqli/tests/mysqli_stmt_big_prepare.phpt
diff --git a/ext/mysqlnd/mysqlnd_ps_codec.c b/ext/mysqlnd/mysqlnd_ps_codec.c
@@ -626,6 +626,7 @@ mysqlnd_stmt_execute_store_params(MYSQLND_STMT * s, zend_uchar **buf, zend_uchar
 		*p += null_count;
 	}
 
+	left = (*buf_len - (*p - *buf));
 /* 1. Store type information */
 	/*
 	  check if need to send the types even if stmt->send_types_to_server is 0. This is because