Hardening the reads of mysqlnd.
All packets but the row data packet are read into preallocated buffer,
either on the stack or on the heap (cmd_buffer). The size of the buffer
is always checked to skip buffer overruns. Only up to the size of the
buffer is stored into the buffer but packet->header.size has the size of
all data sent. In this case network layer bails.
This patch hardenes the reads, so if packets are malformed and shorter
than they should be there will be no further reads in the buffer.
In short, detection of malformed packets.
Adam Harvey [Tue, 20 Apr 2010 04:31:11 +0000 (04:31 +0000)]
Added explanatory comments to filter_input and filter_input_array to document
why some code that looks intuitively wrong is actually correct. Related to
bug #51344 (FILTER_NULL_ON_FAILURE flag automatically set in filter_input()
functions).
make sure the actual length of the argument passed matches the
length of the argument declared
this fixes things like `php --zend-exten=1` or `php-fpm --fpm-con=conf`
Fixint INT_AND_FLOAT_AS native. It was working ok on 64bit but
because on 32bit SIZEOF_LONG is 4 and INT64 from MySQL is 8 everything
was converted to string, even if it was able to put it in a long.
This closes Request #50651 Native type cast returns wrong result
Recommit with an Windows build fix:
Fix inconsistencies
- memory allocated with spprintf, or likes, outside of mysqlnd's
allocator functions should not be freed by the mysqlnd's allocator
(a wrapper around emalloc/malloc).
- memory allocated by the mysqlnd's allocator should only be freed
by it.
- add a mode to track memory usage (malloc/free)
Pierre Joye [Thu, 1 Apr 2010 20:21:50 +0000 (20:21 +0000)]
- revert revision 297277, break the builds (declaration must go 1st, size of void * and other known situations). Also Johannes, can you check that commit pls? Thought we were in bugs fixing only for 5.3
Fix inconsistencies
- memory allocated with spprintf, or likes, outside of mysqlnd's
allocator functions should not be freed by the mysqlnd's allocator
(a wrapper around emalloc/malloc).
- memory allocated by the mysqlnd's allocator should only be freed
by it.
- add a mode to track memory usage (malloc/free)
Fixed bug #51347 mysqli_close / connection memory leak
Streams API registers every stream as resource, which lands then
in EG(regular_list), however doesn't clean that when the stream is
closed. At the end this is a para-leak. At the end of the script
all memory is cleaned, however this is a problem for long runnig
scripts that open connections. For every opened and closed connection
about 150 Bytes on 32bit and 250 Bytes on 64bit will be "lost",
according to memory_get_usage().
Andrey Hristov [Mon, 29 Mar 2010 17:04:16 +0000 (17:04 +0000)]
Make it coupled - what is allocated with mnd_ should be freed
with mnd_ and vice versa.
Added mnd_pestrndup and mnd_pestrdup, which wrap the normal
calls to be able to track this calls.
Fixed some failing tests.
Andrey Hristov [Fri, 26 Mar 2010 16:58:25 +0000 (16:58 +0000)]
Fix tests that fail when the MySQL's socket file is not /tmp/mysql.sock
as it is in when compiled from source and the default for mysqlnd.
SuSE for example uses /var/run/mysql/mysql.sock . Also, sql.safe_mode
(ext/mysql and ingres) needs the socket.
Fix possible crashes in mysqlnd. When packets are shorter, functions should
return error.
Andrei Zmievski [Thu, 18 Mar 2010 22:37:25 +0000 (22:37 +0000)]
I am sorry I tried fixing PHP without extensive discussion on the mailing list.
I am sorry I tried fixing PHP without extensive discussion on the mailing list.
I am sorry I tried fixing PHP without extensive discussion on the mailing list.
projects / php / log