database/sql: check for arg counts after eliminating arguments

Check for the expected number of arguments in a SQL statement
after arguments are eliminated in the argument converter.

This situation was already tested for in TestNamedValueChecker.
However the test used Exec which didn't have any check for
NumInput on it at all, thus this issue was never caught.

In addition to moving the NumInput check on the Query
methods after the converter, add the NumInput check
to the Exec methods as well.

Fixes #22630

Change-Id: If45920c6e1cf70dca63822a0cedec2cdc5cc611c
Reviewed-on: https://go-review.googlesource.com/76732
Run-TryBot: Daniel Theophanes <kardianos@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>

diff --git a/src/database/sql/sql.go b/src/database/sql/sql.go
index 1192eaae2606e7fe6330aa8d0eea1ee7e0d1a18d..22458c0aeb6a45fe91bdddfad8ec3e4ed62dda09 100644 (file)
--- a/src/database/sql/sql.go
+++ b/src/database/sql/sql.go
@@ -2256,6 +2256,13 @@ func resultFromStatement(ctx context.Context, ci driver.Conn, ds *driverStmt, ar
                return nil, err
        }
 
+       // -1 means the driver doesn't know how to count the number of
+       // placeholders, so we won't sanity check input here and instead let the
+       // driver deal with errors.
+       if want := ds.si.NumInput(); want >= 0 && want != len(dargs) {
+               return nil, fmt.Errorf("sql: statement expects %d inputs; got %d", want, len(dargs))
+       }
+
        resi, err := ctxDriverStmtExec(ctx, ds.si, dargs)
        if err != nil {
                return nil, err
@@ -2422,18 +2429,16 @@ func rowsiFromStatement(ctx context.Context, ci driver.Conn, ds *driverStmt, arg
        ds.Lock()
        defer ds.Unlock()
 
-       want := ds.si.NumInput()
+       dargs, err := driverArgsConnLocked(ci, ds, args)
+       if err != nil {
+               return nil, err
+       }
 
        // -1 means the driver doesn't know how to count the number of
        // placeholders, so we won't sanity check input here and instead let the
        // driver deal with errors.
-       if want != -1 && len(args) != want {
-               return nil, fmt.Errorf("sql: statement expects %d inputs; got %d", want, len(args))
-       }
-
-       dargs, err := driverArgsConnLocked(ci, ds, args)
-       if err != nil {
-               return nil, err
+       if want := ds.si.NumInput(); want >= 0 && want != len(dargs) {
+               return nil, fmt.Errorf("sql: statement expects %d inputs; got %d", want, len(dargs))
        }
 
        rowsi, err := ctxDriverStmtQuery(ctx, ds.si, dargs)