Bug #78797 [NEW]: mysqlnd cannot read large OK/ERR packets

From: as@php.net Operating system: PHP version: 7.4.0RC5 Package: PDO MySQL Bug Type: Bug Bug description:mysqlnd cannot read large OK/ERR packets Description: ------------ mysqlnd hits this condition[0] when it receives an OK/ERR packet larger than mysqlnd.net_cmd_buffer_size, resulting in "Error reading result set's header...". These packets have variable-length fields (e.g., error_message[1]) which are not guaranteed to fit in a statically-sized buffer. I'm unsure if popular MySQL versions (Oracle, Percona, MariaDB) will ever emit such packets, however some niche servers that speak the MySQL protocol (e.g., Vitess) do. [0] https://github.com/php/php-src/blob/4d529757f84cb81d5eba53e77e8395efe4e54334/ext/mysqlnd/mysqlnd_wireprotocol.c#L300-L304 [1] https://dev.mysql.com/doc/internals/en/packet-ERR_Packet.html Test script: --------------- Normal behavior (ERR packet shorter than mysqlnd.net_cmd_buffer_size) ``` $ # Fake MySQL server that sends handshake, then OK, then 4kb ERR packet $ { echo -en "\x34\x00\x00\x00\x0aversion\x00TTTTAAAAAAAA\x00\x00\x00\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; echo -en "\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00"; echo -en "\x00\x10\x00\x01\xff\xff\xff$(for i in {1..4093}; do echo -n A; done)" ; } | nc -l 1234 $ php -n -r '$p = new PDO("mysql:host=127.0.0.1;port=1234", "user", "pass", [ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ]); $p->query("select 1");' Fatal error: Uncaught PDOException: SQLSTATE[HY000]: General error: 65535 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA in Command line code:1 Stack trace: #0 Command line code(1): PDO->query('select 1') #1 {main} thrown in Command line code on line 1 ``` Bug behavior (ERR packet longer than mysqlnd.net_cmd_buffer_size) ``` $ # Fake MySQL server that sends handshake, then OK, then 8kb ERR packet $ { echo -en "\x34\x00\x00\x00\x0aversion\x00TTTTAAAAAAAA\x00\x00\x00\x3f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; echo -en "\x07\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00"; echo -en "\x00\x20\x00\x01\xff\xff\xff$(for i in {1..8189}; do echo -n A; done)" ; } | nc -l 1234 $ php -n -r '$p = new PDO("mysql:host=127.0.0.1;port=1234", "user", "pass", [ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ]); $p->query("select 1");' Warning: PDO::query(): Error reading result set's header in Command line code on line 1 ``` -- Edit bug report at https://bugs.php.net/bug.php?id=78797&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78797&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78797&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78797&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78797&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78797&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78797&r=support Expected behavior: https://bugs.php.net/fix.php?id=78797&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78797&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78797&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78797&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78797&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78797&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78797&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78797&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78797&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78797&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78797&r=mysqlcfg