Bug #63700 [Opn->Asn]: Buffer overrun in mysqlnd_reverse_api_register_api

Edit report at https://bugs.php.net/bug.php?id=63700&edit=1 ID: 63700 Updated by: johannes@php.net Reported by: slangley at google dot com Summary: Buffer overrun in mysqlnd_reverse_api_register_api -Status: Open +Status: Assigned Type: Bug Package: MySQL related Operating System: N/A PHP Version: 5.4.9 -Assigned To: +Assigned To: mysql Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2012-12-05 20:01:57] slangley at google dot com Description: ------------ Address sanitizer detected a buffer over run. ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff149259af at pc 0x7f3cfb7b1840 bp 0x7fff149258d0 sp 0x7fff149258c8 READ of size 1 at 0x7fff149259af thread T0 #0 0x7f3cfb7b183f php/v5_4_8/Zend/zend_hash.c:261 _zend_hash_add_or_update #1 0x7f3cfba67ea1 php/v5_4_8/ext/mysqlnd/mysqlnd_reverse_api.c:63 mysqlnd_reverse_api_register_api #2 0x7f3cfbb64bd3 php/v5_4_8/ext/pdo_mysql/pdo_mysql.c:123 zm_startup_pdo_mysql #3 0x7f3cfb55af8d php/v5_4_8/Zend/zend_API.c:1661 zend_startup_module_ex #4 0x7f3cfb7b5041 php/v5_4_8/Zend/zend_hash.c:716 zend_hash_apply #5 0x7f3cfb55ba8e php/v5_4_8/Zend/zend_API.c:1788 zend_startup_modules #6 0x7f3cfbf3b447 php/v5_4_8/main/main.c:2205 php_module_startup Here's the patch to fix it --- v5_4_8/ext/mysqlnd/mysqlnd_reverse_api.c.orig 2012-12-05 11:50:33.000000000 -0800 +++ v5_4_8/ext/mysqlnd/mysqlnd_reverse_api.c 2012-12-05 11:50:52.000000000 -0800 @@ -61,7 +61,7 @@ mysqlnd_reverse_api_register_api(MYSQLND_REVERSE_API * apiext TSRMLS_DC) { zend_hash_add(&mysqlnd_api_ext_ht, apiext->module->name, strlen(apiext- >module->name) + 1, &apiext, - sizeof(MYSQLND_REVERSE_API), NULL); + sizeof(void*), NULL); } /* }}} */ ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=63700&edit=1