php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #37620 mysqli_ssl_set validation is innappropriate
Submitted: 2006-05-29 01:43 UTC Modified: 2006-05-29 05:39 UTC
From: ap at zip dot com dot au Assigned: georg (profile)
Status: Closed Package: MySQLi related
PHP Version: 5.1.4 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: ap at zip dot com dot au
New email:
PHP Version: OS:

 

 [2006-05-29 01:43 UTC] ap at zip dot com dot au 
Description:
------------
When the validation code was introduced to fix bug #36802 a seemingly blind change was made to all (probably - I did not count :) the functions to validate against MYSQLI_STATUS_VALID as can be seen here: 

http://cvs.php.net/viewcvs.cgi/php-src/ext/mysqli/mysqli_api.c?r1=1.118.2.18&r2=1.118.2.19

This doesn't work for mysqli_ssl_set as it needs to be called before a connection to the mysql server is made and as such, judging by the documentation here:

http://cvs.php.net/viewcvs.cgi/php-src/ext/mysqli/mysqli_api.c?view=log#rev1.118.2.19

MYSQLI_STATUS_INITIALIZED appears to be a better test to validate against.

Have patch. Hopefully will be able to attach it once I submit it.


Reproduce code:
---------------
$db = mysqli_init();
mysqli_ssl_set($db,$key, $cert, $cacert, NULL,NULL);
exit;


Expected result:
----------------
*nothing*

Actual result:
--------------
Warning: mysqli_ssl_set(): invalid object or resource mysqli in test.php on line 5

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-05-29 01:45 UTC] ap at zip dot com dot au 
Well I can't see an 'upload patch' thingy so here goes:

--- ext/mysqli/mysqli_api.c.old	2006-05-29 11:34:32.000000000 +1000
+++ ext/mysqli/mysqli_api.c	2006-05-29 11:34:34.000000000 +1000
@@ -1770,7 +1770,7 @@
 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Osssss", &mysql_link, mysqli_link_class_entry, &ssl_parm[0], &ssl_parm_len[0], &ssl_parm[1], &ssl_parm_len[1], &ssl_parm[2], &ssl_parm_len[2], &ssl_parm[3], &ssl_parm_len[3], &ssl_parm[4], &ssl_parm_len[4])   == FAILURE) {
 		return;
 	}
-	MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, &mysql_link, "mysqli_link", MYSQLI_STATUS_VALID);
+	MYSQLI_FETCH_RESOURCE(mysql, MY_MYSQL *, &mysql_link, "mysqli_link", MYSQLI_STATUS_INITIALIZED);
 
 	for (i=0; i < 5; i++) {
 		if (!ssl_parm_len[i]) {
 [2006-05-29 05:39 UTC] georg@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 13:01:29 2024 UTC