php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #46437 data leakage because of nonexisting boundary checking in statements for MySQL41
Submitted: 2008-10-31 17:50 UTC Modified: 2009-04-27 11:11 UTC
Votes:2
Avg. Score:4.0 ± 1.0
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:1 (50.0%)
From: hostmaster at uuism dot net Assigned: mysql (profile)
Status: Not a bug Package: MySQL related
PHP Version: 5.2CVS-2008-10-31 OS: Fedora Core 4
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: hostmaster at uuism dot net
New email:
PHP Version: OS:

 

 [2008-10-31 17:50 UTC] hostmaster at uuism dot net
Description:
------------
When I run ext/mysqli/tests/bug38710.phpt with PHP 5.2.6 and MySQL 4.1.20, the scripts fails in a manner not anticipated by the test script.

The $text consists of 8240 a's followed by a string of non-printable characters (cat -v shows "^@^@^@^Y^@^@^@^M ^@^@M-t^OM-TM-7M-0LM-TM-7M-^@WM^H^@^@^@^@M--M-^F^A^@^Y^@^@^@"), followed by more a's with the non-printable characters repeated every 8000 a's or so.

The string $text is not equal to str_repeat('a', 8191) for mysqli_get_server_version($db)=401020, so the ACTUAL output is:

int(100000)
Done

Thanks.

Jim

Reproduce code:
---------------
<?php
include "connect.inc";

$db = new mysqli($host, $user, $passwd, "test");
$qry=$db->stmt_init();
$qry->prepare("SELECT REPEAT('a',100000)");
$qry->execute();
$qry->bind_result($text);
$qry->fetch();
if ($text !== str_repeat('a', mysqli_get_server_version($db) > 50110? 100000:(mysqli_get_server_version($db)>=50000? 8193:8191))) {
        var_dump(strlen($text));
}
echo "Done";
?>


Expected result:
----------------
It should pass since this is expected behavior for MySQL prior to version 5.1

Actual result:
--------------
It failed

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-11-01 03:30 UTC] hostmaster at uuism dot net
I compiled php5.2-200810312330 and ran test script ext/mysqli/tests/bug38710.phpt with the same results.

The resulting $text does not match str_repeat('a', 8191) for MySQL version 40120.  The length of $text is 100000.  It consists of groups of 8240 a's with mostly non-printing characters between each group.

The non-printing characters always seem to start with zeros (^@), so if you could truncate $text before the first binary zero, it would match str_repeat('a', 8240) 

Thanks for looking into this problem.

Jim
 [2009-04-27 11:11 UTC] johannes@php.net
This is a libmysql issue, libmysql 4.1 isn'T supported anymore, later versions are fixed.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Dec 27 02:01:29 2024 UTC