Skip to content

Commit a32afd9

Browse files
committed
Fix buffer overrun issue with MySQL
`Vec::reserve` ensures that `self.capacity() >= self.len() + additional`, not `self.capacity() >= original_capacity + additional`. If we don't set the length before this call, we aren't necessarily actually allocating to be the size we want to be, and risk a buffer overrun.
1 parent 08df5fa commit a32afd9

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

diesel/src/mysql/connection/bind.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ impl BindData {
155155

156156
debug_assert!(truncated_amount > 0, "output buffers were invalidated \
157157
without calling `mysql_stmt_bind_result`");
158+
self.bytes.set_len(offset);
158159
self.bytes.reserve(truncated_amount);
159160
self.bytes.set_len(self.length as usize);
160161

0 commit comments

Comments
 (0)