1--TEST-- 2GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - upsert filename buffer over-read) 3--EXTENSIONS-- 4mysqli 5--FILE-- 6<?php 7require_once 'fake_server.inc'; 8 9$servername = "127.0.0.1"; 10$username = "root"; 11$password = ""; 12 13$process = run_fake_server_in_background('upsert_response_filename_over_read'); 14$process->wait(); 15 16$conn = new mysqli($servername, $username, $password, "", $process->getPort()); 17echo "[*] Running query on the fake server...\n"; 18 19$result = $conn->query("SELECT * from users"); 20$info = mysqli_info($conn); 21 22var_dump($info); 23 24$process->terminate(); 25 26print "done!"; 27?> 28--EXPECTF-- 29[*] Server started on 127.0.0.1:%d 30[*] Connection established 31[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264 32[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31 33[*] Sending - Server OK: 0700000200000002000000 34[*] Running query on the fake server... 35[*] Received: 140000000353454c454354202a2066726f6d207573657273 36[*] Sending - Malicious Tabular Response [Extract heap through buffer over-read]: 0900000100000000000000fa65 37 38Warning: mysqli::query(): RSET_HEADER packet additional data length is past 249 bytes the packet size in %s on line %d 39 40Warning: mysqli::query(): Error reading result set's header in %s on line %d 41NULL 42done! 43
