#35759 [NEW]: mysqli_stmt_bind_result() makes huge allocation when column empty

From: squasar at eternalviper dot net Operating system: * PHP version: 5.1.1 PHP Bug Type: MySQLi related Bug description: mysqli_stmt_bind_result() makes huge allocation when column empty Description: ------------ If a MEDIUMBLOB column has an empty value (length of zero), mysqli_stmt_bind_result() attempts to allocate a buffer of 16M for it. The offending code is in mysqli_api.c, line 332: if (stmt->stmt->fields[ofs].max_length == 0) { This will be true if the column is empty as well as in the case where the user has not called store_result(). The result is the code using the value of length instead of max_length, which is 16M for a mediumblob. Reproduce code: --------------- Assume there exists a table: CREATE TABLE a_table ( some_blob MEDIUMBLOB NOT NULL ); <?php $m = new mysqli( MY_DB_HOST, MY_DB_USER, MY_DB_PASS ); $s = new mysqli_stmt( $m, "SELECT some_blob FROM a_table WHERE some_blob='' LIMIT 1" ); $s->execute(); $s->store_result(); print_r( $s->result_metadata()->fetch_fields() ); $s->bind_result( $data ); $s->fetch(); print_r( $data ); ?> Expected result: ---------------- Array ( [0] => stdClass Object ( [name] => some_blob [orgname] => some_blob [table] => a_table [orgtable] => a_table [def] => [max_length] => 0 [length] => 0 [charsetnr] => 63 [flags] => 144 [type] => 252 [decimals] => 0 ) ) Actual result: -------------- Array ( [0] => stdClass Object ( [name] => some_blob [orgname] => some_blob [table] => a_table [orgtable] => a_table [def] => [max_length] => 0 [length] => 16777215 [charsetnr] => 63 [flags] => 144 [type] => 252 [decimals] => 0 ) ) Fatal error: Allowed memory size of 8388608 bytes exhausted (tried to allocate 16777216 bytes) in test.php on line 8 -- Edit bug report at http://bugs.php.net/?id=35759&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=35759&r=trysnapshot44 Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=35759&r=trysnapshot51 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=35759&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=35759&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=35759&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=35759&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=35759&r=needscript Try newer version: http://bugs.php.net/fix.php?id=35759&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=35759&r=support Expected behavior: http://bugs.php.net/fix.php?id=35759&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=35759&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=35759&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=35759&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=35759&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=35759&r=dst IIS Stability: http://bugs.php.net/fix.php?id=35759&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=35759&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=35759&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=35759&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=35759&r=mysqlcfg