database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

Bug#17583: mysql drops connection when stdout is not writable

Browse Source 
When the client program had its stdout file descriptor closed by the calling
shell, after some amount of work (enough to fill a socket buffer) the server 
would complain about a packet error and then disconnect the client.

This is a serious security problem.  If stdout is closed before the mysql is
exec()d, then the first socket() call allocates file number 1 to communicate
with the server.  Subsequent write()s to that file number (as when printing
results that come back from the database) go back to the server instead in 
the command channel.  So, one should be able to craft data which, upon being
selected back from the server to the client, and injected into the command
stream become valid MySQL protocol to do something nasty when sent /back/ to 
the server.

The solution is to close explicitly the file descriptor that we *printf() to, 
so that the libc layer and the OS layer both agree that the file is closed.
This commit is contained in:
cmiller@zippy.cornsilk.net
2006-10-09 18:28:06 -04:00
parent 72ad606ece
commit 4812d81eab
4 changed files with 49 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
client/mysql.cc
View File

@ -372,6 +372,21 @@ int main(int argc,char *argv[])
else
status.add_to_history=1;
status.exit_status=1;
{
/*
The file descriptor-layer may be out-of-sync with the file-number layer,
so we make sure that "stdout" is really open. If its file is closed then
explicitly close the FD layer.
*/
int stdout_fileno_copy;
stdout_fileno_copy= dup(fileno(stdout)); /* Okay if fileno fails. */
if (stdout_fileno_copy == -1)
fclose(stdout);
else
close(stdout_fileno_copy); /* Clean up dup(). */
}
load_defaults("my",load_default_groups,&argc,&argv);
defaults_argv=argv;
if (get_options(argc, (char **) argv))