[php-src] PR #23497: [mysqlnd] Fix OK packet message length buffer over-read
| From: | iliaal | Date: | Sat, 29 Aug 2026 12:02:09 +0000 |
| Subject: | [php-src] PR #23497: [mysqlnd] Fix OK packet message length buffer over-read | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38191@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23497
Author: iliaal
php_mysqlnd_ok_read() reads the length-encoded message length after its last bounds check, so a
hostile varint at the end of an OK packet filling the 4096-byte buffer pushes p past header.size and
the buffer end, underflows the MIN(net_len, buf_len - (p - begin)) clamp, and mnd_pestrndup() copies
attacker-controlled bytes beyond the allocation. Smaller packets left stale command-buffer content
in the message. A message length that extends past the payload is now rejected, matching
php_mysqlnd_auth_response_read() from GHSA-h35g-vwh6-m678.