Fixed possible buffer overflow in mysqlnd_conn__list_fields.

diff --git a/NEWS b/NEWS
index 808725476b23a25644241d5d5d20aab2c4dc5d05..9e46316cb511fc45bd0cdb0d038132e411a408c4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,7 @@ PHP                                                                        NEWS
 
 - Implemented FR#35638 (Adding udate to imap_fetch_overview results).
   (Charles_Duffy at dell dot com )
+- Fixed possible buffer overflow in mysqlnd_list_fields. (Andrey)
 
 - Fixed handling of session variable serialization on certain prefix
   characters. Reported by Stefan Esser (Ilia)

diff --git a/ext/mysqlnd/mysqlnd.c b/ext/mysqlnd/mysqlnd.c
index 69c294368eea5f74065a5696ed4fccb6837062a9..df400f1e5ee6b063531508c564219286c7c3b8df 100644 (file)
--- a/ext/mysqlnd/mysqlnd.c
+++ b/ext/mysqlnd/mysqlnd.c
@@ -1074,14 +1074,16 @@ MYSQLND_METHOD(mysqlnd_conn, list_fields)(MYSQLND * conn, const char *table, con
 
        p = buff;
        if (table && (table_len = strlen(table))) {
-               memcpy(p, table, MIN(table_len, MYSQLND_MAX_ALLOWED_DB_LEN * 4));
-               p += table_len;
+               size_t to_copy = MIN(table_len, MYSQLND_MAX_ALLOWED_DB_LEN * 4);
+               memcpy(p, table, to_copy);
+               p += to_copy;
                *p++ = '\0';
        }
 
        if (achtung_wild && (wild_len = strlen(achtung_wild))) {
-               memcpy(p, achtung_wild, MIN(wild_len, MYSQLND_MAX_ALLOWED_DB_LEN * 4));
-               p += wild_len;
+               size_t to_copy = MIN(wild_len, MYSQLND_MAX_ALLOWED_DB_LEN * 4);
+               memcpy(p, achtung_wild, to_copy);
+               p += to_copy;
                *p++ = '\0';
        }