mariadb-connector-c

mirror of https://github.com/mariadb-corporation/mariadb-connector-c.git synced 2026-10-23 21:28:58 +03:00

Files

Georg Richter dd532fcc1c CONC-850: Fix out-of-bounds reads in parse_server_packet (GSSAPI)

Replace strncpy/strnlen parsing in plugins/auth/auth_gssapi_client.c
with bounded memchr/memcpy calls to prevent two security vulnerabilities:

1. Stack Buffer Over-Read: Oversized SPN inputs without a NUL byte caused
   strncpy to omit NUL-termination, leading to OOB reads in strlen().
2. Packet Over-Read: Malformed packets missing a NUL terminator caused
   mechanism parsing to read past the end of the packet buffer.

Thanks to Aisle Research for reporting this issue

2026-09-03 11:54:55 +02:00