From: squasar at eternalviper dot net
Operating system: *
PHP version: 5.1.1
PHP Bug Type: MySQLi related
Bug description: mysqli_stmt_bind_result() makes huge allocation when column
empty
Description:
------------
If a MEDIUMBLOB column has an empty value (length of zero),
mysqli_stmt_bind_result() attempts to allocate a buffer of 16M
for it. The offending code is in mysqli_api.c, line 332:
if (stmt->stmt->fields[ofs].max_length == 0) {
This will be true if the column is empty as well as in the
case where the user has not called store_result(). The result
is the code using the value of length instead of max_length,
which is 16M for a mediumblob.
Reproduce code:
---------------
Assume there exists a table:
CREATE TABLE a_table ( some_blob MEDIUMBLOB NOT NULL );
<?php
$m = new mysqli( MY_DB_HOST, MY_DB_USER, MY_DB_PASS );
$s = new mysqli_stmt( $m, "SELECT some_blob FROM a_table WHERE
some_blob='' LIMIT 1" );
$s->execute();
$s->store_result();
print_r( $s->result_metadata()->fetch_fields() );
$s->bind_result( $data );
$s->fetch();
print_r( $data );
?>
Expected result:
----------------
Array
(
[0] => stdClass Object
(
[name] => some_blob
[orgname] => some_blob
[table] => a_table
[orgtable] => a_table
[def] =>
[max_length] => 0
[length] => 0
[charsetnr] => 63
[flags] => 144
[type] => 252
[decimals] => 0
)
)
Actual result:
--------------
Array
(
[0] => stdClass Object
(
[name] => some_blob
[orgname] => some_blob
[table] => a_table
[orgtable] => a_table
[def] =>
[max_length] => 0
[length] => 16777215
[charsetnr] => 63
[flags] => 144
[type] => 252
[decimals] => 0
)
)
Fatal error: Allowed memory size of 8388608 bytes exhausted
(tried to allocate 16777216 bytes) in test.php on line 8
--
Edit bug report at http://bugs.php.net/?id=35759&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=35759&r=trysnapshot44
Try a CVS snapshot (PHP 5.1):
http://bugs.php.net/fix.php?id=35759&r=trysnapshot51
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=35759&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=35759&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=35759&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=35759&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=35759&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=35759&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=35759&r=support
Expected behavior: http://bugs.php.net/fix.php?id=35759&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=35759&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=35759&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=35759&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=35759&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=35759&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=35759&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=35759&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=35759&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=35759&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=35759&r=mysqlcfg
