Bug #77076 mysql_close causes stack corruption

Description:
*Note: first I want to declare this a poor design. Memory allocation and de-allocation should be separated out from _init and _close. But since it is there...

mysql_init needs to set the MYSQL.free_me flag to true if a user passes NULL otherwise it should be set to false.
mysql_close needs to check the MYSQL.free_me to see if it should call free() to deallocate memory.

mysql_close documentation states that it will delete the MYSQL object if it was allocated by msyql_init(...) or msyql_connect(...)

However, mysql_init never sets the free_me flag and mysql_close never checks it. Thus, it will attempt to delete an object declared on the stack.

How to repeat:
void mysql_stack_corruption_bug()
{
    MYSQL temp;
    mysql_init(&temp);
    // you might call mysql_real_connect(...) but not necessary to reproduce
    // the bug.
    mysql_close(&temp); // causes stack corruption
}

I found this using Boost Test Framework which checks for stack corruption.

Suggested fix:
mysql_init needs to set the MYSQL.free_me flag to true if a user passes NULL otherwise it should be set to false.
mysql_close needs to check the MYSQL.free_me to see if it should call free() to deallocate memory.

Hi,

There seems to be a problem here, partially instigated by us. Regarding the "Category" field. libmysqld is a server library that you can use to make your program running without using a separate server deamon.

But, as you are using here C Connector, I guess that it is libmysql that you are using.

In versions 5.6 and 5.7 of MySQL, `free_me` field is used extensively where  it is supposed to be used.

Here is the relevant excerpt from mysql_init():
---
  if (!mysql)
  {
    if (!(mysql=(MYSQL*) my_malloc(key_memory_MYSQL,
                                   sizeof(*mysql),MYF(MY_WME | MY_ZEROFILL))))
    {
      set_mysql_error(NULL, CR_OUT_OF_MEMORY, unknown_sqlstate);
      return 0;
    }
    mysql->free_me=1;
  }
----

And here is the relevant excerpt from mysql_close():
---

    if (mysql->free_me)
      my_free(mysql);

---

Hence, everything is just fine. So, it would be nice to know which library did you use exactly and how did you observe the effect of stack corruption.

Thanks in advance.

No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".