Merge branch 'PHP-7.4' into PHP-8.0

imme-emosol · Jun 6, 2022 · e864cb6 · e864cb6
2 parents bfe63f5 + d1be936
commit e864cb6
Show file tree

Hide file tree

Showing 3 changed files with 32 additions and 4 deletions.
diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c
@@ -776,7 +776,8 @@ php_mysqlnd_change_auth_response_write(MYSQLND_CONN_DATA * conn, void * _packet)
 	MYSQLND_VIO * vio = conn->vio;
 	MYSQLND_STATS * stats = conn->stats;
 	MYSQLND_CONNECTION_STATE * connection_state = &conn->state;
-	zend_uchar * const buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len);
+	size_t total_packet_size = packet->auth_data_len + MYSQLND_HEADER_SIZE;
+	zend_uchar * const buffer = pfc->cmd_buffer.length >= total_packet_size? pfc->cmd_buffer.buffer : mnd_emalloc(total_packet_size);
 	zend_uchar * p = buffer + MYSQLND_HEADER_SIZE; /* start after the header */
 
 	DBG_ENTER("php_mysqlnd_change_auth_response_write");

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
@@ -1122,7 +1122,7 @@ PHP_FUNCTION(pg_query_params)
 			} else {
 				zend_string *param_str = zval_try_get_string(tmp);
 				if (!param_str) {
-					_php_pgsql_free_params(params, num_params);
+					_php_pgsql_free_params(params, i);
 					RETURN_THROWS();
 				}
 				params[i] = estrndup(ZSTR_VAL(param_str), ZSTR_LEN(param_str));
@@ -3920,8 +3920,8 @@ PHP_FUNCTION(pg_send_execute)
 				params[i] = NULL;
 			} else {
 				zend_string *tmp_str = zval_try_get_string(tmp);
-				if (UNEXPECTED(!tmp)) {
-					_php_pgsql_free_params(params, num_params);
+				if (UNEXPECTED(!tmp_str)) {
+					_php_pgsql_free_params(params, i);
 					return;
 				}
 				params[i] = estrndup(ZSTR_VAL(tmp_str), ZSTR_LEN(tmp_str));

diff --git a/ext/pgsql/tests/bug81720.phpt b/ext/pgsql/tests/bug81720.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #81720 (Uninitialized array in pg_query_params() leading to RCE)
+--SKIPIF--
+<?php include("skipif.inc"); ?>
+--FILE--
+<?php
+include('config.inc');
+
+$conn = pg_connect($conn_str);
+
+try {
+    pg_query_params($conn, 'SELECT $1, $2', [1, new stdClass()]);
+} catch (Throwable $ex) {
+    echo $ex->getMessage(), PHP_EOL;
+}
+
+try {
+    pg_send_prepare($conn, "my_query", 'SELECT $1, $2');
+    pg_get_result($conn);
+    pg_send_execute($conn, "my_query", [1, new stdClass()]);
+} catch (Throwable $ex) {
+    echo $ex->getMessage(), PHP_EOL;
+}
+?>
+--EXPECT--
+Object of class stdClass could not be converted to string
+Object of class stdClass could not be converted to string