database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

protect from [heap] buffer overrrun by malicious server

Browse Source
This commit is contained in:
serg@serg.mysql.com
2002-12-04 01:26:32 +01:00
parent 33de7e55f9
commit 615c94655d
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
libmysql/libmysql.c
View File

@ -307,7 +307,7 @@ net_safe_read(MYSQL *mysql)
DBUG_PRINT("error",("Wrong connection or packet. fd: %s len: %d", DBUG_PRINT("error",("Wrong connection or packet. fd: %s len: %d",
vio_description(net->vio),len)); vio_description(net->vio),len));
end_server(mysql); end_server(mysql);
net->last_errno=(net->last_errno == ER_NET_PACKET_TOO_LARGE ? net->last_errno=(net->last_errno == ER_NET_PACKET_TOO_LARGE ?
CR_NET_PACKET_TOO_LARGE: CR_NET_PACKET_TOO_LARGE:
CR_SERVER_LOST); CR_SERVER_LOST);
strmov(net->last_error,ER(net->last_errno)); strmov(net->last_error,ER(net->last_errno));
@ -891,7 +891,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
uint field,pkt_len; uint field,pkt_len;
ulong len; ulong len;
uchar *cp; uchar *cp;
char *to; char *to, *end_to;
MYSQL_DATA *result; MYSQL_DATA *result;
MYSQL_ROWS **prev_ptr,*cur; MYSQL_ROWS **prev_ptr,*cur;
NET *net = &mysql->net; NET *net = &mysql->net;
@ -929,6 +929,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
*prev_ptr=cur; *prev_ptr=cur;
prev_ptr= &cur->next; prev_ptr= &cur->next;
to= (char*) (cur->data+fields+1); to= (char*) (cur->data+fields+1);
end_to=to+pkt_len-1;
for (field=0 ; field < fields ; field++) for (field=0 ; field < fields ; field++)
{ {
if ((len=(ulong) net_field_length(&cp)) == NULL_LENGTH) if ((len=(ulong) net_field_length(&cp)) == NULL_LENGTH)
@ -938,6 +939,13 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
else else
{ {
cur->data[field] = to; cur->data[field] = to;
if (to+len > end_to)
{
free_rows(result);
net->last_errno=CR_UNKNOWN_ERROR;
strmov(net->last_error,ER(net->last_errno));
DBUG_RETURN(0);
}
memcpy(to,(char*) cp,len); to[len]=0; memcpy(to,(char*) cp,len); to[len]=0;
to+=len+1; to+=len+1;
cp+=len; cp+=len;