database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-09-02 09:41:40 +03:00
Code Activity

Bug#42634: % character in query can cause mysqld signal 11 segfault

Browse Source 
The problem is that a unfiltered user query was being passed as
the format string parameter of sql_print_warning which later
performs printf-like formatting, leading to crashes if the user
query contains formatting instructions (ie: %s). Also, it was
using THD::query as the source of the user query, but this
variable is not meaningful in some situations -- in a delayed
insert, it points to the table name.

The solution is to pass the user query as a parameter for the
format string and use the function parameter query_arg as the
source of the user query.
This commit is contained in:
Davi Arnaut
2009-02-09 16:17:58 -02:00
parent 7a6c62c4ff
commit 33a36ce9e7
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sql/sql_class.cc
View File

@@ -3660,16 +3660,14 @@ int THD::binlog_query(THD::enum_binlog_query_type qtype, char const *query_arg,
if (lex->is_stmt_unsafe() &&
variables.binlog_format == BINLOG_FORMAT_STMT)
{
DBUG_ASSERT(this->query != NULL);
push_warning(this, MYSQL_ERROR::WARN_LEVEL_WARN,
ER_BINLOG_UNSAFE_STATEMENT,
ER(ER_BINLOG_UNSAFE_STATEMENT));
if (!(binlog_flags & BINLOG_FLAG_UNSAFE_STMT_PRINTED))
{
char warn_buf[MYSQL_ERRMSG_SIZE];
my_snprintf(warn_buf, MYSQL_ERRMSG_SIZE, "%s Statement: %s",
ER(ER_BINLOG_UNSAFE_STATEMENT), this->query);
sql_print_warning(warn_buf);
sql_print_warning("%s Statement: %.*s",
ER(ER_BINLOG_UNSAFE_STATEMENT),
MYSQL_ERRMSG_SIZE, query_arg);
binlog_flags|= BINLOG_FLAG_UNSAFE_STMT_PRINTED;
}
}