DBD-mysql-CVE-2016-1246.patch

From 3c4342d182f8e7b1ea9a8d907de65ec6338b4d53 Mon Sep 17 00:00:00 2001
From: Pali <pali@cpan.org>
Date: Sat, 24 Sep 2016 14:47:59 +0200
Subject: [PATCH] Do not use unsafe sprintf w/variable length input

This can cause a  buffer overflow to occur when reporting
error message about validation of (untrusted) user input parameters.
---
 dbdimp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dbdimp.c b/dbdimp.c
index afb6766..3ebcc62 100644
--- a/dbdimp.c
+++ b/dbdimp.c
@@ -4868,7 +4868,7 @@ int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,
   int rc;
   int param_num= SvIV(param);
   int idx= param_num - 1;
-  char err_msg[64];
+  char *err_msg;
   D_imp_xxh(sth);

 #if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION
@@ -4911,9 +4911,9 @@ int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,
   {
     if (! looks_like_number(value))
     {
-      sprintf(err_msg,
+      err_msg = SvPVX(sv_2mortal(newSVpvf(
               "Binding non-numeric field %d, value %s as a numeric!",
-              param_num, neatsvpv(value,0));
+              param_num, neatsvpv(value,0))));
       do_error(sth, JW_ERR_ILLEGAL_PARAM_NUM, err_msg, NULL);
     }
   }
--
2.10.0