Edit report at https://bugs.php.net/bug.php?id=63700&edit=1
ID: 63700
Updated by: johan...@php.net
Reported by: slangley at google dot com
Summary: Buffer overrun in mysqlnd_reverse_api_register_api
-Status: Open
+Status: Assigned
Type: Bug
Package: MySQL related
Operating System: N/A
PHP Version: 5.4.9
-Assigned To:
+Assigned To: mysql
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2012-12-05 20:01:57] slangley at google dot com
Description:
------------
Address sanitizer detected a buffer over run.
ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff149259af at pc
0x7f3cfb7b1840 bp 0x7fff149258d0 sp 0x7fff149258c8
READ of size 1 at 0x7fff149259af thread T0
#0 0x7f3cfb7b183f php/v5_4_8/Zend/zend_hash.c:261 _zend_hash_add_or_update
#1 0x7f3cfba67ea1 php/v5_4_8/ext/mysqlnd/mysqlnd_reverse_api.c:63
mysqlnd_reverse_api_register_api
#2 0x7f3cfbb64bd3 php/v5_4_8/ext/pdo_mysql/pdo_mysql.c:123
zm_startup_pdo_mysql
#3 0x7f3cfb55af8d php/v5_4_8/Zend/zend_API.c:1661 zend_startup_module_ex
#4 0x7f3cfb7b5041 php/v5_4_8/Zend/zend_hash.c:716 zend_hash_apply
#5 0x7f3cfb55ba8e php/v5_4_8/Zend/zend_API.c:1788 zend_startup_modules
#6 0x7f3cfbf3b447 php/v5_4_8/main/main.c:2205 php_module_startup
Here's the patch to fix it
--- v5_4_8/ext/mysqlnd/mysqlnd_reverse_api.c.orig 2012-12-05
11:50:33.000000000 -0800
+++ v5_4_8/ext/mysqlnd/mysqlnd_reverse_api.c 2012-12-05 11:50:52.000000000
-0800
@@ -61,7 +61,7 @@
mysqlnd_reverse_api_register_api(MYSQLND_REVERSE_API * apiext TSRMLS_DC)
{
zend_hash_add(&mysqlnd_api_ext_ht, apiext->module->name, strlen(apiext-
>module->name) + 1, &apiext,
- sizeof(MYSQLND_REVERSE_API), NULL);
+ sizeof(void*), NULL);
}
/* }}} */
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=63700&edit=1
