database/sql: check for arg counts after eliminating arguments

Check for the expected number of arguments in a SQL statement
after arguments are eliminated in the argument converter.

This situation was already tested for in TestNamedValueChecker.
However the test used Exec which didn't have any check for
NumInput on it at all, thus this issue was never caught.

In addition to moving the NumInput check on the Query
methods after the converter, add the NumInput check
to the Exec methods as well.

Fixes #22630

Change-Id: If45920c6e1cf70dca63822a0cedec2cdc5cc611c
Reviewed-on: https://go-review.googlesource.com/76732
Run-TryBot: Daniel Theophanes <kardianos@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>

1 files changed, 13 insertions, 8 deletions

diff --git a/src/database/sql/sql.go b/src/database/sql/sql.go
index 1192eaae26..22458c0aeb 100644
--- a/src/database/sql/sql.go
+++ b/src/database/sql/sql.go
@@ -2256,6 +2256,13 @@ func resultFromStatement(ctx context.Context, ci driver.Conn, ds *driverStmt, ar
 		return nil, err
 	}
 
+	// -1 means the driver doesn't know how to count the number of
+	// placeholders, so we won't sanity check input here and instead let the
+	// driver deal with errors.
+	if want := ds.si.NumInput(); want >= 0 && want != len(dargs) {
+		return nil, fmt.Errorf("sql: statement expects %d inputs; got %d", want, len(dargs))
+	}
+
 	resi, err := ctxDriverStmtExec(ctx, ds.si, dargs)
 	if err != nil {
 		return nil, err
@@ -2422,18 +2429,16 @@ func rowsiFromStatement(ctx context.Context, ci driver.Conn, ds *driverStmt, arg
 	ds.Lock()
 	defer ds.Unlock()
 
-	want := ds.si.NumInput()
+	dargs, err := driverArgsConnLocked(ci, ds, args)
+	if err != nil {
+		return nil, err
+	}
 
 	// -1 means the driver doesn't know how to count the number of
 	// placeholders, so we won't sanity check input here and instead let the
 	// driver deal with errors.
-	if want != -1 && len(args) != want {
-		return nil, fmt.Errorf("sql: statement expects %d inputs; got %d", want, len(args))
-	}
-
-	dargs, err := driverArgsConnLocked(ci, ds, args)
-	if err != nil {
-		return nil, err
+	if want := ds.si.NumInput(); want >= 0 && want != len(dargs) {
+		return nil, fmt.Errorf("sql: statement expects %d inputs; got %d", want, len(dargs))
 	}
 
 	rowsi, err := ctxDriverStmtQuery(ctx, ds.si, dargs)