database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

protocol: verify that number of rows is correct

Browse Source
This commit is contained in:
Sergei Golubchik
2018-05-04 00:09:45 +02:00
parent fab383aac0
commit 1d58d184c2
1 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
sql-common/client.c
View File

@ -1483,7 +1483,9 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
{ {
uchar *pos; uchar *pos;
/* fields count may be wrong */ /* fields count may be wrong */
DBUG_ASSERT((uint) (field - result) < fields); if (field - result >= fields)
goto err;
cli_fetch_lengths(&lengths[0], row->data, default_value ? 8 : 7); cli_fetch_lengths(&lengths[0], row->data, default_value ? 8 : 7);
field->catalog= strmake_root(alloc,(char*) row->data[0], lengths[0]); field->catalog= strmake_root(alloc,(char*) row->data[0], lengths[0]);
field->db= strmake_root(alloc,(char*) row->data[1], lengths[1]); field->db= strmake_root(alloc,(char*) row->data[1], lengths[1]);
@ -1501,12 +1503,7 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
/* Unpack fixed length parts */ /* Unpack fixed length parts */
if (lengths[6] != 12) if (lengths[6] != 12)
{ goto err;
/* malformed packet. signal an error. */
free_rows(data); /* Free old data */
set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate);
DBUG_RETURN(0);
}
pos= (uchar*) row->data[6]; pos= (uchar*) row->data[6];
field->charsetnr= uint2korr(pos); field->charsetnr= uint2korr(pos);
@ -1533,6 +1530,8 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
/* old protocol, for backward compatibility */ /* old protocol, for backward compatibility */
for (row=data->data; row ; row = row->next,field++) for (row=data->data; row ; row = row->next,field++)
{ {
if (field - result >= fields)
goto err;
cli_fetch_lengths(&lengths[0], row->data, default_value ? 6 : 5); cli_fetch_lengths(&lengths[0], row->data, default_value ? 6 : 5);
field->org_table= field->table= strdup_root(alloc,(char*) row->data[0]); field->org_table= field->table= strdup_root(alloc,(char*) row->data[0]);
field->name= strdup_root(alloc,(char*) row->data[1]); field->name= strdup_root(alloc,(char*) row->data[1]);
@ -1569,8 +1568,17 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
} }
} }
#endif /* DELETE_SUPPORT_OF_4_0_PROTOCOL */ #endif /* DELETE_SUPPORT_OF_4_0_PROTOCOL */
if (field - result < fields)
goto err;
free_rows(data); /* Free old data */ free_rows(data); /* Free old data */
DBUG_RETURN(result); DBUG_RETURN(result);
err:
/* malformed packet. signal an error. */
free_rows(data);
free_root(alloc, MYF(0));
set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate);
DBUG_RETURN(0);
} }
/* Read all rows (fields or data) from server */ /* Read all rows (fields or data) from server */