From: domas at mysql dot com
Operating system: Any
PHP version: 5.1.6
PHP Bug Type: MySQLi related
Bug description: data leakage because of nonexisting boundary checking in
statements
Description:
------------
If function is executed in a prepared statement (like CONCAT,
UNCOMPRESS, etc), it allocates 8192-sized buffer, but fetch()
doesn't check actual length of data. If data crosses 8192-byte
boundary, all sorts of weird stuff starts to happen, including
possible sensitive data disclosures of non-overwrited buffers
(at smaller lengths) or process crashes (at bigger ones).
Reproduce code:
---------------
$db=new mysqli("localhost","root","","test");
$qry=$db->stmt_init();
$qry->prepare("SELECT REPEAT('a',100000)");
$qry->execute();
$qry->bind_result($text);
$qry->fetch();
Expected result:
----------------
silence
Actual result:
--------------
crash!
--
Edit bug report at http://bugs.php.net/?id=38710&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=38710&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=38710&r=trysnapshot52
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=38710&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=38710&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=38710&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=38710&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=38710&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=38710&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=38710&r=support
Expected behavior: http://bugs.php.net/fix.php?id=38710&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=38710&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=38710&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=38710&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38710&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=38710&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=38710&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=38710&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=38710&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=38710&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=38710&r=mysqlcfg
