Repository navigation
Fix GH-23956: Regression with MySQL 4.1 after mysqlnd security fix - #24432
Open
jeroenvdkolff wants to merge 1 commit into
Open
jeroenvdkolff wants to merge 1 commit into
jeroenvdkolff wants to merge 1 commit into
Conversation
The fix for GHSA-r6x9-5r99-36j7 made 1-byte EOF and auth switch packets fail the length check after reading the first byte. MySQL 4.1 sends such packets. Only require more data in the error branch, which actually reads it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jeroenvdkolff
requested review from
SakiTakamachi,
bukka and
kamil-tekiela
as code owners
October 19, 2026 13:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GH-23956
Since the fix for GHSA-r6x9-5r99-36j7, PHP can no longer run queries on a MySQL 4.1 server. You get "Premature end of data" and "EOF packet shorter than expected".
Cause
MySQL 4.1 sometimes sends an EOF packet of only 1 byte. The code already has a branch to handle this (the
elseinphp_mysqlnd_eof_read()). But the new checkBAIL_IF_NOT_ENOUGH_DATAafterp++requires at least 2 bytes. The oldBAIL_IF_NO_MORE_DATAdid not require that. So that branch can no longer be reached.The same happens in
php_mysqlnd_auth_response_read()with a 1-byte0xFEpacket. There it only adds two extra warnings before the normal "old insecure authentication" error.Fix
I moved the check into the
ERROR_MARKERbranch, because that is the only branch that reads more data. The other checks from the security fix are not changed.Tests
gh23956.phpt(1-byte EOF) andgh23956_2.phpt(1-byte auth response). Both fail without the fix and pass with it.ghsa-r6x9-5r99-36j7-*tests.oblakstudio/mysql41). Queries, prepared statements and PDO work again. With the fullext/mysqliandext/pdo_mysqltest suites, 421 tests that failed before no longer fail. Six tests could not run before, because their SKIPIF crashed on this bug. Now they run, but fail because of MySQL 4.1 limitations (no SSL, older SQL syntax, older transaction behaviour). This does not affect modern MySQL or MariaDB versions.Note
I am not a C developer, and I made this fix with help from an AI assistant. I did test it myself, as described above. I am happy to change anything, or to move the PR to another branch if needed.