database/mariadb-connector-c
1
0
Fork 0
mirror of https://github.com/mariadb-corporation/mariadb-connector-c.git synced 2025-08-01 06:27:04 +03:00
Code Activity

Merge branch '3.1' into 3.3

Browse Source
This commit is contained in:
Georg Richter
2024-12-12 10:43:07 +01:00
parent 16e5b88bab 6bf9557d00
commit d90e911ef6
1 changed files with 25 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
libmariadb/mariadb_lib.c
View File

@ -159,6 +159,16 @@ static int cli_report_progress(MYSQL *mysql, uchar *packet, uint length);
extern int mysql_client_plugin_init();
extern void mysql_client_plugin_deinit();
/* Helper function to detect possible buffer over- or underflow */
my_bool ma_check_buffer_boundaries(MYSQL *mysql, uchar *current_pos,
ulong packet_size, size_t required)
{
if ( (packet_size < (ulong)(current_pos - mysql->net.read_pos)) ||
((size_t)(packet_size - (current_pos - mysql->net.read_pos)) < required))
return 1;
return 0;
}
/* net_get_error */
void net_get_error(char *buf, size_t buf_len,
char *error, size_t error_len,
@ -1058,10 +1068,13 @@ unpack_fields(const MYSQL *mysql,
for (i=0; i < field_count; i++)
{
uint length= (uint)(row->data[i+1] - row->data[i] - 1);
if (!row->data[i] || row->data[i][length])
uint length;
if (!row->data[i])
goto error;
length= (uint)(row->data[i+1] - row->data[i] - 1);
*(char **)(((char *)field) + rset_field_offsets[i*2])=
ma_strdup_root(alloc, (char *)row->data[i]);
*(unsigned int *)(((char *)field) + rset_field_offsets[i*2+1])= length;
@ -2594,6 +2607,9 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
unsigned int last_status= mysql->server_status;
mysql->affected_rows= net_field_length_ll(&pos);
mysql->insert_id= net_field_length_ll(&pos);
if (ma_check_buffer_boundaries(mysql, pos, length, 2))
goto corrupted;
mysql->server_status=uint2korr(pos);
/* clear error */
@ -2602,6 +2618,8 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
/* callback */
ma_status_callback(mysql, last_status);
pos+=2;
if (ma_check_buffer_boundaries(mysql, pos, length, 2))
goto corrupted;
mysql->warning_count=uint2korr(pos);
pos+=2;
if (pos > end)
@ -2610,7 +2628,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
{
if ((item_len= net_field_length(&pos)))
mysql->info=(char*) pos;
if (pos + item_len > end)
if (ma_check_buffer_boundaries(mysql, pos, length, item_len))
goto corrupted;
/* check if server supports session tracking */
@ -2628,7 +2646,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
uchar *old_pos= pos;
item_len= net_field_length(&pos); /* length for all items */
if (pos + item_len > end)
if (ma_check_buffer_boundaries(mysql, pos, length, item_len))
goto corrupted;
end= pos + item_len;
@ -2659,7 +2677,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
net_field_length(&pos);
}
plen= net_field_length(&pos);
if (pos + plen > end)
if (ma_check_buffer_boundaries(mysql, pos, length, plen))
goto corrupted;
data1.str= (char *)pos;
@ -2688,7 +2706,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
if (!strncmp(data1.str, "character_set_client", plen))
set_charset= 1;
plen= net_field_length(&pos);
if (pos + plen > end)
if (ma_check_buffer_boundaries(mysql, pos, length, plen))
goto corrupted;
data2.str= (char *)pos;
data2.length= plen;
@ -2715,7 +2733,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
default:
/* not supported yet */
plen= net_field_length(&pos);
if (pos + plen > end)
if (ma_check_buffer_boundaries(mysql, pos, length, plen))
goto corrupted;
pos+= plen;
break;