Repository navigation
Conversation
iliaal
force-pushed
the
fix/aph-mysqlnd-result-memset-null-deref-84
branch
from
November 7, 2026 18:24
45826ac to
99302f0
Compare
iliaal
changed the title
When the EOF packet after result set metadata could not be read, both mysqlnd_stmt_prepare_read_eof() and mysqlnd_query_read_result_set_header() memset the whole statement, clearing error_info, upsert_status and conn, so the next errno or error access dereferenced NULL. Free only the result and keep the statement intact. A short EOF packet now sets CR_MALFORMED_PACKET, and a failed prepare copies the connection error to the statement, so the failure is reported instead of returning false with errno 0.
iliaal
force-pushed
the
fix/aph-mysqlnd-result-memset-null-deref-84
branch
from
November 7, 2026 19:21
99302f0 to
c79c11d
Compare
Owner
Author
|
Submitted upstream as php#25297. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When the EOF packet after result set metadata cannot be read,
mysqlnd_stmt_prepare_read_eof()andmysqlnd_query_read_result_set_header()both memset the whole statement, clearingerror_info,upsert_status, andconn. The next errno or error access on the statement then dereferences NULL. A server that sends a truncated EOF packet, or closes the connection after the column definitions, crashesmysqli_stmt::execute(),PDOStatement::execute(), andmysqli_stmt::prepare()afterstmt_init().Both sites now free only the result and keep the statement intact, matching the store-result failure handling in
mysqlnd_ps.c. A short EOF packet setsCR_MALFORMED_PACKET, and a failed prepare copies the connection error to the statement, so the failure is reported instead of returning false with errno 0.Reproduced with the
fake_server.incharness on an ASAN build of PHP-8.4: SEGV at 0x250 inmysqlnd_stmt_execute_parse_response()and at 0x208 inmysqlnd_stmt_errno_pub(). The five new tests are red before and green after;ghsa-r6x9-5r99-36j7-stmt-response-row-status.phptnow asserts the exception that was previously missing.