database/mariadb-connector-c
1
0
Fork 0
mirror of https://github.com/mariadb-corporation/mariadb-connector-c.git synced 2025-08-07 02:42:49 +03:00
Code Activity

Merge branch '3.1' into 3.3

Browse Source
This commit is contained in:
Georg Richter
2024-12-12 10:43:07 +01:00
parent 16e5b88bab 6bf9557d00
commit d90e911ef6
1 changed files with 25 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
libmariadb/mariadb_lib.c
View File

@@ -159,6 +159,16 @@ static int cli_report_progress(MYSQL *mysql, uchar *packet, uint length);
extern int mysql_client_plugin_init(); extern int mysql_client_plugin_init();
extern void mysql_client_plugin_deinit(); extern void mysql_client_plugin_deinit();
/* Helper function to detect possible buffer over- or underflow */
my_bool ma_check_buffer_boundaries(MYSQL *mysql, uchar *current_pos,
ulong packet_size, size_t required)
{
if ( (packet_size < (ulong)(current_pos - mysql->net.read_pos)) ||
((size_t)(packet_size - (current_pos - mysql->net.read_pos)) < required))
return 1;
return 0;
}
/* net_get_error */ /* net_get_error */
void net_get_error(char *buf, size_t buf_len, void net_get_error(char *buf, size_t buf_len,
char *error, size_t error_len, char *error, size_t error_len,
@@ -1058,10 +1068,13 @@ unpack_fields(const MYSQL *mysql,
for (i=0; i < field_count; i++) for (i=0; i < field_count; i++)
{ {
uint length= (uint)(row->data[i+1] - row->data[i] - 1); uint length;
if (!row->data[i] || row->data[i][length])
if (!row->data[i])
goto error; goto error;
length= (uint)(row->data[i+1] - row->data[i] - 1);
*(char **)(((char *)field) + rset_field_offsets[i*2])= *(char **)(((char *)field) + rset_field_offsets[i*2])=
ma_strdup_root(alloc, (char *)row->data[i]); ma_strdup_root(alloc, (char *)row->data[i]);
*(unsigned int *)(((char *)field) + rset_field_offsets[i*2+1])= length; *(unsigned int *)(((char *)field) + rset_field_offsets[i*2+1])= length;
@@ -2594,6 +2607,9 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
unsigned int last_status= mysql->server_status; unsigned int last_status= mysql->server_status;
mysql->affected_rows= net_field_length_ll(&pos); mysql->affected_rows= net_field_length_ll(&pos);
mysql->insert_id= net_field_length_ll(&pos); mysql->insert_id= net_field_length_ll(&pos);
if (ma_check_buffer_boundaries(mysql, pos, length, 2))
goto corrupted;
mysql->server_status=uint2korr(pos); mysql->server_status=uint2korr(pos);
/* clear error */ /* clear error */
@@ -2602,6 +2618,8 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
/* callback */ /* callback */
ma_status_callback(mysql, last_status); ma_status_callback(mysql, last_status);
pos+=2; pos+=2;
if (ma_check_buffer_boundaries(mysql, pos, length, 2))
goto corrupted;
mysql->warning_count=uint2korr(pos); mysql->warning_count=uint2korr(pos);
pos+=2; pos+=2;
if (pos > end) if (pos > end)
@@ -2610,7 +2628,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
{ {
if ((item_len= net_field_length(&pos))) if ((item_len= net_field_length(&pos)))
mysql->info=(char*) pos; mysql->info=(char*) pos;
if (pos + item_len > end) if (ma_check_buffer_boundaries(mysql, pos, length, item_len))
goto corrupted; goto corrupted;
/* check if server supports session tracking */ /* check if server supports session tracking */
@@ -2628,7 +2646,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
uchar *old_pos= pos; uchar *old_pos= pos;
item_len= net_field_length(&pos); /* length for all items */ item_len= net_field_length(&pos); /* length for all items */
if (pos + item_len > end) if (ma_check_buffer_boundaries(mysql, pos, length, item_len))
goto corrupted; goto corrupted;
end= pos + item_len; end= pos + item_len;
@@ -2659,7 +2677,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
net_field_length(&pos); net_field_length(&pos);
} }
plen= net_field_length(&pos); plen= net_field_length(&pos);
if (pos + plen > end) if (ma_check_buffer_boundaries(mysql, pos, length, plen))
goto corrupted; goto corrupted;
data1.str= (char *)pos; data1.str= (char *)pos;
@@ -2688,7 +2706,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
if (!strncmp(data1.str, "character_set_client", plen)) if (!strncmp(data1.str, "character_set_client", plen))
set_charset= 1; set_charset= 1;
plen= net_field_length(&pos); plen= net_field_length(&pos);
if (pos + plen > end) if (ma_check_buffer_boundaries(mysql, pos, length, plen))
goto corrupted; goto corrupted;
data2.str= (char *)pos; data2.str= (char *)pos;
data2.length= plen; data2.length= plen;
@@ -2715,7 +2733,7 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
default: default:
/* not supported yet */ /* not supported yet */
plen= net_field_length(&pos); plen= net_field_length(&pos);
if (pos + plen > end) if (ma_check_buffer_boundaries(mysql, pos, length, plen))
goto corrupted; goto corrupted;
pos+= plen; pos+= plen;
break; break;