database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

Bug#21973610: BUFFER OVERFLOW ISSUES

Browse Source 
Description : Incorrect usage of sprintf/strcpy caused
              possible buffer overflow issues at various
              places.

Solution : - Fixed mysql_plugin and mysqlshow
           - Fixed regex library issues

Reviewed-By : Georgi Kodinov <georgi.kodinov@oracle.com>
Reviewed-By : Venkata S Murthy Sidagam <venkata.sidagam@oracle.com>
This commit is contained in:
Harin Vadodaria
2015-11-06 16:41:55 +05:30
parent fd9831410d
commit 0dbd5a8797
4 changed files with 42 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
client/mysqlshow.c
View File

@ -377,7 +377,7 @@ list_dbs(MYSQL *mysql,const char *wild)
uint length, counter = 0;
ulong rowcount = 0L;
char tables[NAME_LEN+1], rows[NAME_LEN+1];
char query[255];
char query[NAME_LEN + 100];
MYSQL_FIELD *field;
MYSQL_RES *result;
MYSQL_ROW row= NULL, rrow;
@ -444,7 +444,8 @@ list_dbs(MYSQL *mysql,const char *wild)
MYSQL_ROW trow;
while ((trow = mysql_fetch_row(tresult)))
{
sprintf(query,"SELECT COUNT(*) FROM `%s`",trow[0]);
my_snprintf(query, sizeof(query),
"SELECT COUNT(*) FROM `%s`", trow[0]);
if (!(mysql_query(mysql,query)))
{
MYSQL_RES *rresult;
@ -500,7 +501,7 @@ list_tables(MYSQL *mysql,const char *db,const char *table)
{
const char *header;
uint head_length, counter = 0;
char query[255], rows[NAME_LEN], fields[16];
char query[NAME_LEN + 100], rows[NAME_LEN], fields[16];
MYSQL_FIELD *field;
MYSQL_RES *result;
MYSQL_ROW row, rrow;
@ -585,7 +586,8 @@ list_tables(MYSQL *mysql,const char *db,const char *table)
if (opt_verbose > 1)
{
/* Print the count of rows for each table */
sprintf(query,"SELECT COUNT(*) FROM `%s`",row[0]);
my_snprintf(query, sizeof(query), "SELECT COUNT(*) FROM `%s`",
row[0]);
if (!(mysql_query(mysql,query)))
{
if ((rresult = mysql_store_result(mysql)))
@ -645,13 +647,15 @@ list_tables(MYSQL *mysql,const char *db,const char *table)
static int
list_table_status(MYSQL *mysql,const char *db,const char *wild)
{
char query[1024],*end;
char query[NAME_LEN + 100];
int len;
MYSQL_RES *result;
MYSQL_ROW row;
end=strxmov(query,"show table status from `",db,"`",NullS);
if (wild && wild[0])
strxmov(end," like '",wild,"'",NullS);
len= sizeof(query);
len-= my_snprintf(query, len, "show table status from `%s`", db);
if (wild && wild[0] && len)
strxnmov(query + strlen(query), len, " like '", wild, "'", NullS);
if (mysql_query(mysql,query) || !(result=mysql_store_result(mysql)))
{
fprintf(stderr,"%s: Cannot get status for db: %s, table: %s: %s\n",
@ -683,7 +687,8 @@ static int
list_fields(MYSQL *mysql,const char *db,const char *table,
const char *wild)
{
char query[1024],*end;
char query[NAME_LEN + 100];
int len;
MYSQL_RES *result;
MYSQL_ROW row;
ulong UNINIT_VAR(rows);
@ -697,7 +702,7 @@ list_fields(MYSQL *mysql,const char *db,const char *table,
if (opt_count)
{
sprintf(query,"select count(*) from `%s`", table);
my_snprintf(query, sizeof(query), "select count(*) from `%s`", table);
if (mysql_query(mysql,query) || !(result=mysql_store_result(mysql)))
{
fprintf(stderr,"%s: Cannot get record count for db: %s, table: %s: %s\n",
@ -709,9 +714,11 @@ list_fields(MYSQL *mysql,const char *db,const char *table,
mysql_free_result(result);
}
end=strmov(strmov(strmov(query,"show /*!32332 FULL */ columns from `"),table),"`");
if (wild && wild[0])
strxmov(end," like '",wild,"'",NullS);
len= sizeof(query);
len-= my_snprintf(query, len, "show /*!32332 FULL */ columns from `%s`",
table);
if (wild && wild[0] && len)
strxnmov(query + strlen(query), len, " like '", wild, "'", NullS);
if (mysql_query(mysql,query) || !(result=mysql_store_result(mysql)))
{
fprintf(stderr,"%s: Cannot list columns in db: %s, table: %s: %s\n",
@ -732,7 +739,7 @@ list_fields(MYSQL *mysql,const char *db,const char *table,
print_res_top(result);
if (opt_show_keys)
{
end=strmov(strmov(strmov(query,"show keys from `"),table),"`");
my_snprintf(query, sizeof(query), "show keys from `%s`", table);
if (mysql_query(mysql,query) || !(result=mysql_store_result(mysql)))
{
fprintf(stderr,"%s: Cannot list keys in db: %s, table: %s: %s\n",