Fixed invalid read

diff --git a/ext/mysqlnd/mysqlnd.c b/ext/mysqlnd/mysqlnd.c
index 4f1587088a39478e60c4d1ebe5be12c33894263d..44d908268cde8ee969f6e4dbb8c1bd85bb99ef47 100644 (file)
--- a/ext/mysqlnd/mysqlnd.c
+++ b/ext/mysqlnd/mysqlnd.c
@@ -2764,7 +2764,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, tx_begin)(MYSQLND_CONN_DATA * conn, const unsi
                do {
                        smart_str tmp_str = {0, 0};
                        if (mode & TRANS_START_WITH_CONSISTENT_SNAPSHOT) {
-                               if (tmp_str.s->len) {
+                               if (tmp_str.s) {
                                        smart_str_appendl(&tmp_str, ", ", sizeof(", ") - 1);
                                }
                                smart_str_appendl(&tmp_str, "WITH CONSISTENT SNAPSHOT", sizeof("WITH CONSISTENT SNAPSHOT") - 1);
@@ -2792,7 +2792,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, tx_begin)(MYSQLND_CONN_DATA * conn, const unsi
                        {
                                char * name_esc = mysqlnd_escape_string_for_tx_name_in_comment(name TSRMLS_CC);
                                char * query;
-                               unsigned int query_len = mnd_sprintf(&query, 0, "START TRANSACTION%s %s", name_esc? name_esc:"", tmp_str.s->val? tmp_str.s->val:"");
+                               unsigned int query_len = mnd_sprintf(&query, 0, "START TRANSACTION%s %s", name_esc? name_esc:"", tmp_str.s? tmp_str.s->val:"");
                                smart_str_free(&tmp_str);
                                if (name_esc) {
                                        mnd_efree(name_esc);

diff --git a/ext/mysqlnd/mysqlnd_ps.c b/ext/mysqlnd/mysqlnd_ps.c
index a72da6e5e997722497b274408eee835a8cb98524..4019aabec053549989ee29ae1ed70d8fffa88d3e 100644 (file)
--- a/ext/mysqlnd/mysqlnd_ps.c
+++ b/ext/mysqlnd/mysqlnd_ps.c
@@ -111,12 +111,12 @@ MYSQLND_METHOD(mysqlnd_stmt, store_result)(MYSQLND_STMT * const s TSRMLS_DC)
                                        DBG_RETURN(NULL);
                                }
                                /* if pecalloc is used valgrind barks gcc version 4.3.1 20080507 (prerelease) [gcc-4_3-branch revision 135036] (SUSE Linux) */
-                               set->data = mnd_emalloc((size_t)(result->stored_data->row_count * result->meta->field_count * sizeof(zval *)));
+                               set->data = mnd_emalloc((size_t)(result->stored_data->row_count * result->meta->field_count * sizeof(zval)));
                                if (!set->data) {
                                        SET_OOM_ERROR(*conn->error_info);
                                        DBG_RETURN(NULL);
                                }
-                               memset(set->data, 0, (size_t)(result->stored_data->row_count * result->meta->field_count * sizeof(zval *)));
+                               memset(set->data, 0, (size_t)(result->stored_data->row_count * result->meta->field_count * sizeof(zval)));;
                        }
                        /* Position at the first row */
                        set->data_cursor = set->data;