Uploaded image for project: 'MariaDB Connector/Python'
  1. MariaDB Connector/Python
  2. CONPY-374

C cursor PyMemberDef widths don't match struct fields (OOB write → segfault)

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Fixed
    • None
    • 1.1.15
    • Other
    • None

    Description

      Four MrdbCursor_Members entries declare a member type whose width doesn't match
      the backing struct field, so the generated getter/setter touches the wrong
      number of bytes:

      arraysize T_LONG -> T_UINT (uint32_t row_array_size) – real bug
      insert_id T_UINT -> T_ULONGLONG (uint64_t lastrow_id, RO) – truncation
      _reprepare T_UINT -> T_UBYTE (uint8_t) – latent
      _command T_BYTE -> T_INT (4-byte enum) – cosmetic

      • arraysize: the 8-byte T_LONG store overruns the adjacent `paraminfo` pointer
        when cursor.arraysize is set; reads return garbage high bits.
      • insert_id: the 4-byte read truncates auto-increment ids > 2^32.
      • _reprepare: 4-byte store over a 1-byte field. Harmless (reprepare is
        followed by padding + weakreflist).
      • _command: 1-byte accessor over a 4-byte enum; read-only with small values, so
        cosmetic.

      Attachments

        Activity

          People

            diego dupin Diego Dupin
            diego dupin Diego Dupin
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.