database/mariadb-connector-c
1
0
Fork 0
mirror of https://github.com/mariadb-corporation/mariadb-connector-c.git synced 2025-08-07 02:42:49 +03:00
Code Activity

various checks for corrupted packets in the protocol

Browse Source 
also: check the return value of unpack_fields()
This commit is contained in:
Sergei Golubchik
2018-05-09 23:07:57 +02:00
parent d70c883422
commit 27b2f3d1f1
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
libmariadb/mariadb_lib.c
View File

@@ -768,6 +768,9 @@ unpack_fields(MYSQL_DATA *data,MA_MEM_ROOT *alloc,uint fields,
for (row=data->data; row ; row = row->next,field++)
{
if (field >= result + fields)
goto error;
for (i=0; i < field_count; i++)
{
switch(row->data[i][0]) {
@@ -809,8 +812,14 @@ unpack_fields(MYSQL_DATA *data,MA_MEM_ROOT *alloc,uint fields,
field->def=0;
field->max_length= 0;
}
if (field < result + fields)
goto error;
free_rows(data); /* Free old data */
return(result);
error:
free_rows(data);
ma_free_root(alloc, MYF(0));
return(0);
}
@@ -867,7 +876,7 @@ MYSQL_DATA *mthd_my_read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
else
{
cur->data[field] = to;
if (len > (ulong) (end_to - to))
if (len > (ulong)(end_to - to) || to > end_to)
{
free_rows(result);
SET_CLIENT_ERROR(mysql, CR_UNKNOWN_ERROR, SQLSTATE_UNKNOWN, 0);
@@ -936,7 +945,7 @@ int mthd_my_read_one_row(MYSQL *mysql,uint fields,MYSQL_ROW row, ulong *lengths)
}
else
{
if (len > (ulong) (end_pos - pos))
if (len > (ulong) (end_pos - pos) || pos > end_pos)
{
mysql->net.last_errno=CR_UNKNOWN_ERROR;
strcpy(mysql->net.last_error,ER(mysql->net.last_errno));
@@ -2446,13 +2455,17 @@ mysql_list_fields(MYSQL *mysql, const char *table, const char *wild)
}
result->field_alloc=mysql->field_alloc;
mysql->fields=0;
result->eof=1;
result->field_count = (uint) query->rows;
result->fields= unpack_fields(query,&result->field_alloc,
result->field_count,1,
(my_bool) test(mysql->server_capabilities &
CLIENT_LONG_FLAG));
result->eof=1;
return(result);
if (result->fields)
return(result);
free(result);
return(NULL);
}
/* List all running processes (threads) in server */