#37620 [Opn->Asn]: mysqli_ssl_set validation is innappropriate
ID: 37620
Updated by: georg@php.net
Reported By: ap at zip dot com dot au
-Status: Open
+Status: Assigned
Bug Type: MySQLi related
Operating System: Linux
PHP Version: 5.1.4
-Assigned To:
+Assigned To: georg
Previous Comments:
------------------------------------------------------------------------
[2006-05-29 01:45:38] ap at zip dot com dot au
Well I can't see an 'upload patch' thingy so here goes:
--- ext/mysqli/mysqli_api.c.old 2006-05-29 11:34:32.000000000 +1000
+++ ext/mysqli/mysqli_api.c 2006-05-29 11:34:34.000000000 +1000
@@ -1770,7 +1770,7 @@
if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC,
getThis(), "Osssss", &mysql_link, mysqli_link_class_entry,
&ssl_parm[0], &ssl_parm_len[0], &ssl_parm[1], &ssl_parm_len[1],
&ssl_parm[2], &ssl_parm_len[2], &ssl_parm[3], &ssl_parm_len[3],
&ssl_parm[4], &ssl_parm_len[4]) == FAILURE) {
return;
}
- MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, &mysql_link, "mysqli_link",
MYSQLI_STATUS_VALID);
+ MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, &mysql_link, "mysqli_link",
MYSQLI_STATUS_INITIALIZED);
for (i=0; i < 5; i++) {
if (!ssl_parm_len[i]) {
------------------------------------------------------------------------
[2006-05-29 01:43:09] ap at zip dot com dot au
Description:
------------
When the validation code was introduced to fix bug #36802 a seemingly
blind change was made to all (probably - I did not count :) the
functions to validate against MYSQLI_STATUS_VALID as can be seen here:
http://cvs.php.net/viewcvs.cgi/php-src/ext/mysqli/mysqli_api.c?r1=1.118.2.18&r2=1.118.2.19
This doesn't work for mysqli_ssl_set as it needs to be called before a
connection to the mysql server is made and as such, judging by the
documentation here:
http://cvs.php.net/viewcvs.cgi/php-src/ext/mysqli/mysqli_api.c?view=log#rev1.118.2.19
MYSQLI_STATUS_INITIALIZED appears to be a better test to validate
against.
Have patch. Hopefully will be able to attach it once I submit it.
Reproduce code:
---------------
$db = mysqli_init();
mysqli_ssl_set($db,$key, $cert, $cacert, NULL,NULL);
exit;
Expected result:
----------------
*nothing*
Actual result:
--------------
Warning: mysqli_ssl_set(): invalid object or resource mysqli in
test.php on line 5
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=37620&edit=1
Thread (4 messages)