guix/gnu/packages/patches/perl-dbd-mysql-CVE-2017-10788.patch

Fix CVE-2017-10788:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10788

Patch written to match corrected documentation specifications:

Old: http://web.archive.org/web/20161220021610/https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-close.html
New: https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-close.html

The patch itself is from https://github.com/perl5-dbi/DBD-mysql/issues/120#issuecomment-312420660.

From 9ce10cfae7138c37c3a0cb2ba2a1d682482943d0 Mon Sep 17 00:00:00 2001
From: Pali <pali@cpan.org>
Date: Sun, 25 Jun 2017 10:07:39 +0200
Subject: [PATCH] Fix use-after-free after calling mysql_stmt_close()

Ignore return value from mysql_stmt_close() and also its error message
because it points to freed memory after mysql_stmt_close() was called.
---
 dbdimp.c |    8 ++------
 mysql.xs |    7 ++-----
 2 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/dbdimp.c b/dbdimp.c
index c60a5f6..a6410e5 100644
--- a/dbdimp.c
+++ b/dbdimp.c
@@ -4894,12 +4894,8 @@ void dbd_st_destroy(SV *sth, imp_sth_t *imp_sth) {

   if (imp_sth->stmt)
   {
-    if (mysql_stmt_close(imp_sth->stmt))
-    {
-      do_error(DBIc_PARENT_H(imp_sth), mysql_stmt_errno(imp_sth->stmt),
-          mysql_stmt_error(imp_sth->stmt),
-          mysql_stmt_sqlstate(imp_sth->stmt));
-    }
+    mysql_stmt_close(imp_sth->stmt);
+    imp_sth->stmt= NULL;
   }
 #endif

diff --git a/mysql.xs b/mysql.xs
index 55376e1..affde59 100644
--- a/mysql.xs
+++ b/mysql.xs
@@ -434,11 +434,8 @@ do(dbh, statement, attr=Nullsv, ...)
       if (bind)
         Safefree(bind);

-      if(mysql_stmt_close(stmt))
-      {
-        fprintf(stderr, "\n failed while closing the statement");
-        fprintf(stderr, "\n %s", mysql_stmt_error(stmt));
-      }
+      mysql_stmt_close(stmt);
+      stmt= NULL;

       if (retval == -2) /* -2 means error */
       {
--
1.7.9.5