From 9c51ea2f41cef3e4103c817d0e4a31a7c7cb8ce2 Mon Sep 17 00:00:00 2001 From: KangBairong <31462570+KangBairong@users.noreply.github.com> Date: Thu, 19 Dec 2024 17:47:41 +0800 Subject: [PATCH] Update mysqlnd_wireprotocol.c Fix bug #81719: mysqlnd/pdo password buffer overflow --- ext/mysqlnd/mysqlnd_wireprotocol.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c index b9cbb1789429c..3f7d6acde851d 100644 --- a/ext/mysqlnd/mysqlnd_wireprotocol.c +++ b/ext/mysqlnd/mysqlnd_wireprotocol.c @@ -792,7 +792,9 @@ php_mysqlnd_change_auth_response_write(void * _packet) MYSQLND_VIO * vio = packet->header.vio; MYSQLND_STATS * stats = packet->header.stats; MYSQLND_CONNECTION_STATE * connection_state = packet->header.connection_state; - zend_uchar * buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len); + // zend_uchar * buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len); + size_t total_packet_size = packet->auth_data_len + MYSQLND_HEADER_SIZE; + zend_uchar * const buffer = pfc->cmd_buffer.length >= total_packet_size? pfc->cmd_buffer.buffer : mnd_emalloc(total_packet_size); zend_uchar * p = buffer + MYSQLND_HEADER_SIZE; /* start after the header */ DBG_ENTER("php_mysqlnd_change_auth_response_write");