From: Anatol Belski <ab@php.net>
Date: Wed, 13 Sep 2017 12:08:25 +0000 (+0200)
Subject: Fixed bug #75018, fixed bug #75177
X-Git-Tag: php-7.2.0RC3~32^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3d93856c4a05394196c5610ae11cf019d1e18f76;p=php

Fixed bug #75018, fixed bug #75177

Both are caused by the same cast issue in mysqlnd on 32-bit.
---

diff --git a/ext/mysqli/tests/bug75018.phpt b/ext/mysqli/tests/bug75018.phpt
new file mode 100644
index 0000000000..20d836166b
--- /dev/null
+++ b/ext/mysqli/tests/bug75018.phpt
@@ -0,0 +1,38 @@
+--TEST--
+Bug #75018 Data corruption when reading fields of bit type
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+require_once("connect.inc");
+
+$mysqli = new mysqli("$host:$port", $user, $passwd, $db);
+
+$tbl = "test_bug75018";
+$sql = "DROP TABLE IF EXISTS $tbl";
+$mysqli->query($sql);
+
+$sql = "CREATE TABLE $tbl (bit_column_1 bit(16) NOT NULL) DEFAULT CHARSET=utf8";
+$mysqli->query($sql);
+
+$sql = "INSERT INTO $tbl (bit_column_1) VALUES (0)";
+$mysqli->query($sql);
+$sql = "INSERT INTO $tbl (bit_column_1) VALUES (0b10101010101)";
+$mysqli->query($sql);
+
+$sql = "SELECT bit_column_1 FROM $tbl";
+$result = $mysqli->query($sql);
+
+while ($row = $result->fetch_assoc()) {
+	var_dump($row['bit_column_1']);
+}
+
+?>
+==DONE==
+--EXPECT--
+string(1) "0"
+string(4) "1365"
+==DONE==
diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c
index 90ae615a1a..0b2039c5c3 100644
--- a/ext/mysqlnd/mysqlnd_wireprotocol.c
+++ b/ext/mysqlnd/mysqlnd_wireprotocol.c
@@ -1761,7 +1761,7 @@ php_mysqlnd_rowp_read_text_protocol_aux(MYSQLND_MEMORY_POOL_CHUNK * row_buffer,
 				if (Z_TYPE_P(current_field) == IS_LONG && !as_int_or_float) {
 					/* we are using the text protocol, so convert to string */
 					char tmp[22];
-					const size_t tmp_len = sprintf((char *)&tmp, MYSQLND_LLU_SPEC, Z_LVAL_P(current_field));
+					const size_t tmp_len = sprintf((char *)&tmp, MYSQLND_LLU_SPEC, (uint64_t) Z_LVAL_P(current_field));
 					ZVAL_STRINGL(current_field, tmp, tmp_len);
 				} else if (Z_TYPE_P(current_field) == IS_STRING) {
 					/* nothing to do here, as we want a string and ps_fetch_from_1_to_8_bytes() has given us one */
diff --git a/ext/pdo_mysql/tests/bug75177.phpt b/ext/pdo_mysql/tests/bug75177.phpt
new file mode 100644
index 0000000000..abdfd3954b
--- /dev/null
+++ b/ext/pdo_mysql/tests/bug75177.phpt
@@ -0,0 +1,33 @@
+--TEST--
+PDO MySQL Bug #75177 Type 'bit' is fetched as unexpected string
+--SKIPIF--
+<?php
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+?>
+--FILE--
+<?php
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+$pdo = MySQLPDOTest::factory();
+
+$tbl = "tbl_bug75177";
+$pdo->query("DROP TABLE IF EXISTS $tbl");
+$pdo->query("CREATE TABLE $tbl (`bit` bit(8)) ENGINE=InnoDB");
+$pdo->query("INSERT INTO $tbl (`bit`) VALUES (1)");
+$pdo->query("INSERT INTO $tbl (`bit`) VALUES (0b011)");
+$pdo->query("INSERT INTO $tbl (`bit`) VALUES (0b01100)");
+
+$ret = $pdo->query("SELECT * FROM $tbl")->fetchAll();
+
+foreach ($ret as $i) {
+	var_dump($i["bit"]);
+}
+
+?>
+==DONE==
+--EXPECT--
+string(1) "1"
+string(1) "3"
+string(2) "12"
+==DONE==