diff options
Diffstat (limited to 'ext/mysqlnd/mysqlnd_wireprotocol.c')
| -rw-r--r-- | ext/mysqlnd/mysqlnd_wireprotocol.c | 25 | 
1 files changed, 18 insertions, 7 deletions
| diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c index 75391d390a..39a3c94b04 100644 --- a/ext/mysqlnd/mysqlnd_wireprotocol.c +++ b/ext/mysqlnd/mysqlnd_wireprotocol.c @@ -777,6 +777,7 @@ void php_mysqlnd_cmd_free_mem(void *_packet, zend_bool alloca TSRMLS_DC)  static enum_func_status  php_mysqlnd_rset_header_read(void *_packet, MYSQLND *conn TSRMLS_DC)  { +	enum_func_status ret = PASS;  	size_t buf_len = conn->net->cmd_buffer.length;  	zend_uchar *buf = (zend_uchar *) conn->net->cmd_buffer.buffer;  	zend_uchar *p = buf; @@ -819,9 +820,14 @@ php_mysqlnd_rset_header_read(void *_packet, MYSQLND *conn TSRMLS_DC)  			*/  			len = packet->header.size - 1;  			packet->info_or_local_file = mnd_emalloc(len + 1); -			memcpy(packet->info_or_local_file, p, len); -			packet->info_or_local_file[len] = '\0'; -			packet->info_or_local_file_len = len; +			if (packet->info_or_local_file) { +				memcpy(packet->info_or_local_file, p, len); +				packet->info_or_local_file[len] = '\0'; +				packet->info_or_local_file_len = len; +			} else { +				SET_OOM_ERROR(conn->error_info); +				ret = FAIL;	 +			}  			break;  		case 0x00:  			DBG_INF("UPSERT"); @@ -841,9 +847,14 @@ php_mysqlnd_rset_header_read(void *_packet, MYSQLND *conn TSRMLS_DC)  			/* Check for additional textual data */  			if (packet->header.size  > (size_t) (p - buf) && (len = php_mysqlnd_net_field_length(&p))) {  				packet->info_or_local_file = mnd_emalloc(len + 1); -				memcpy(packet->info_or_local_file, p, len); -				packet->info_or_local_file[len] = '\0'; -				packet->info_or_local_file_len = len; +				if (packet->info_or_local_file) { +					memcpy(packet->info_or_local_file, p, len); +					packet->info_or_local_file[len] = '\0'; +					packet->info_or_local_file_len = len; +				} else { +					SET_OOM_ERROR(conn->error_info); +					ret = FAIL; +				}  			}  			DBG_INF_FMT("affected_rows=%llu last_insert_id=%llu server_status=%d warning_count=%d",  						packet->affected_rows, packet->last_insert_id, @@ -856,7 +867,7 @@ php_mysqlnd_rset_header_read(void *_packet, MYSQLND *conn TSRMLS_DC)  	}  	BAIL_IF_NO_MORE_DATA; -	DBG_RETURN(PASS); +	DBG_RETURN(ret);  premature_end:  	DBG_ERR_FMT("RSET_HEADER packet %d bytes shorter than expected", p - begin - packet->header.size);  	php_error_docref(NULL TSRMLS_CC, E_WARNING, "RSET_HEADER packet "MYSQLND_SZ_T_SPEC" bytes shorter than expected", | 
