• Harin Vadodaria's avatar
    Bug#25988681: USE-AFTER-FREE IN MYSQL_STMT_CLOSE() · 3d8134d2
    Harin Vadodaria authored
    Description: If mysql_stmt_close() encountered error,
                 it recorded error in prepared statement
                 but then frees memory assigned to prepared
                 statement. If mysql_stmt_error() is used
                 to get error information, it will result
                 into use after free.
    
                 In all cases where mysql_stmt_close() can
                 fail, error would have been set by
                 cli_advanced_command in MYSQL structure.
    
    Solution: Don't copy error from MYSQL using set_stmt_errmsg.
              There is no automated way to test the fix since
              it is in mysql_stmt_close() which does not expect
              any reply from server.
    Reviewed-By: default avatarGeorgi Kodinov <georgi.kodinov@oracle.com>
    Reviewed-By: default avatarRamil Kalimullin <ramil.kalimullin@oracle.com>
    3d8134d2
libmysql.c 135 KB