com php-src: Fixed invalid read: ext/mysqlnd/mysqlnd.c ext/mysqlnd/mysqlnd_ps.c

Commit: f81498c8c868ef88a652649c1bd608f8898a3cac Author: Xinchen Hui <laruence@php.net> Thu, 19 Jun 2014 15:49:56 +0800 Parents: ffaf8beda769f5353e3991947884aac0cfd64f43 Branches: phpng Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=f81498c8c868ef88a652649c1bd608f8898a3cac Log: Fixed invalid read Changed paths: M ext/mysqlnd/mysqlnd.c M ext/mysqlnd/mysqlnd_ps.c Diff: diff --git a/ext/mysqlnd/mysqlnd.c b/ext/mysqlnd/mysqlnd.c index 4f15870...44d9082 100644 --- a/ext/mysqlnd/mysqlnd.c +++ b/ext/mysqlnd/mysqlnd.c @@ -2764,7 +2764,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, tx_begin)(MYSQLND_CONN_DATA * conn, const unsi do { smart_str tmp_str = {0, 0}; if (mode & TRANS_START_WITH_CONSISTENT_SNAPSHOT) { - if (tmp_str.s->len) { + if (tmp_str.s) { smart_str_appendl(&tmp_str, ", ", sizeof(", ") - 1); } smart_str_appendl(&tmp_str, "WITH CONSISTENT SNAPSHOT", sizeof("WITH CONSISTENT SNAPSHOT") - 1); @@ -2792,7 +2792,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, tx_begin)(MYSQLND_CONN_DATA * conn, const unsi { char * name_esc = mysqlnd_escape_string_for_tx_name_in_comment(name TSRMLS_CC); char * query; - unsigned int query_len = mnd_sprintf(&query, 0, "START TRANSACTION%s %s", name_esc? name_esc:"", tmp_str.s->val? tmp_str.s->val:""); + unsigned int query_len = mnd_sprintf(&query, 0, "START TRANSACTION%s %s", name_esc? name_esc:"", tmp_str.s? tmp_str.s->val:""); smart_str_free(&tmp_str); if (name_esc) { mnd_efree(name_esc); diff --git a/ext/mysqlnd/mysqlnd_ps.c b/ext/mysqlnd/mysqlnd_ps.c index a72da6e..4019aab 100644 --- a/ext/mysqlnd/mysqlnd_ps.c +++ b/ext/mysqlnd/mysqlnd_ps.c @@ -111,12 +111,12 @@ MYSQLND_METHOD(mysqlnd_stmt, store_result)(MYSQLND_STMT * const s TSRMLS_DC) DBG_RETURN(NULL); } /* if pecalloc is used valgrind barks gcc version 4.3.1 20080507 (prerelease) [gcc-4_3-branch revision 135036] (SUSE Linux) */ - set->data = mnd_emalloc((size_t)(result->stored_data->row_count * result->meta->field_count * sizeof(zval *))); + set->data = mnd_emalloc((size_t)(result->stored_data->row_count * result->meta->field_count * sizeof(zval))); if (!set->data) { SET_OOM_ERROR(*conn->error_info); DBG_RETURN(NULL); } - memset(set->data, 0, (size_t)(result->stored_data->row_count * result->meta->field_count * sizeof(zval *))); + memset(set->data, 0, (size_t)(result->stored_data->row_count * result->meta->field_count * sizeof(zval)));; } /* Position at the first row */ set->data_cursor = set->data;