svn: /php/php-src/ branches/PHP_5_3/ext/mysqlnd/mysqlnd_wireprotocol.c trunk/ext/mysqlnd/mysqlnd_wireprotocol.c

andrey Tue, 20 Apr 2010 20:02:32 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=298235 Log: Hardening the reads of mysqlnd. All packets but the row data packet are read into preallocated buffer, either on the stack or on the heap (cmd_buffer). The size of the buffer is always checked to skip buffer overruns. Only up to the size of the buffer is stored into the buffer but packet->header.size has the size of all data sent. In this case network layer bails. This patch hardenes the reads, so if packets are malformed and shorter than they should be there will be no further reads in the buffer. In short, detection of malformed packets. Changed paths: U php/php-src/branches/PHP_5_3/ext/mysqlnd/mysqlnd_wireprotocol.c U php/php-src/trunk/ext/mysqlnd/mysqlnd_wireprotocol.c

Attachment: [text/x-diff] svn-diffs-298235.txt