Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mysqli flaky test: ghsa-h35g-vwh6-m678-stmt-row-string #17499

Open
morrisonlevi opened this issue Jan 17, 2025 · 0 comments
Open

mysqli flaky test: ghsa-h35g-vwh6-m678-stmt-row-string #17499

morrisonlevi opened this issue Jan 17, 2025 · 0 comments

Comments

@morrisonlevi
Copy link
Contributor

Description

This newish test is flaky:

--
     [*] Sending - Malicious Stmt Response for items [Extract heap through buffer over-read]: 01000001013000000203646566087068705f74657374056974656d73056974656d73046974656d046974656d0ce000c8000000fd011000000005000003fe00002200070000040000fa7465737405000005fe00002200
     
     Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %d
013- [*] Received: 0500000019010000000100000001
013+ [*] Received: 050000001901000000
     [*] Server finished
     done!
========DONE========
FAIL GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row string buffer over-read) [ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-string.phpt] 

The Received line comes from this code:

    public function read($bytes_len = 1024)
    {
        // wait 20ms to fill the buffer
        usleep(20000);
        $data = fread($this->conn, $bytes_len);
        if ($data) {
            fprintf(STDERR, "[*] Received: %s\n", bin2hex($data));
        }
    }

It seems as if there's a partial read of the data.

I don't have time right now to dig into the root and try and fix it. If no one else does either, we can at least add:

--FLAKY--
Sometimes get a partial read like:
013- [*] Received: 0500000019010000000100000001
013+ [*] Received: 050000001901000000

PHP Version

PHP 8.4

Operating System

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants