server: check an array out of range for malform packet (pingcap#2048)

indescribable · Nov 21, 2016 · 6b444f8 · 6b444f8
1 parent af5b0e7
commit 6b444f8
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/server/conn_stmt.go b/server/conn_stmt.go
@@ -185,6 +185,10 @@ func parseStmtArgs(args []interface{}, boundParams [][]byte, nullBitmap, paramTy
 			continue
 		}
 
+		if (i<<1)+1 >= len(paramTypes) {
+			return mysql.ErrMalformPacket
+		}
+
 		tp := paramTypes[i<<1]
 		isUnsigned := (paramTypes[(i<<1)+1] & 0x80) > 0