database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-11-13 21:42:58 +03:00
Code Activity

MDEV-17589: Stack-buffer-overflow with indexed varchar (utf8) field

Browse Source 
Create a new constant MAX_DATA_LENGTH_FOR_KEY.
Replace the value of MAX_KEY_LENGTH to also include the LENGTH and NULL BYTES
of a field.
This commit is contained in:
Varun Gupta
2018-12-19 10:34:30 +05:30
parent da4efd56aa
commit 7e606a2d5c
6 changed files with 79 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
sql/handler.h
View File

@@ -384,6 +384,12 @@ enum enum_alter_inplace_result {
#define HA_KEY_NULL_LENGTH 1
#define HA_KEY_BLOB_LENGTH 2
/* Maximum length of any index lookup key, in bytes */
#define MAX_KEY_LENGTH (MAX_DATA_LENGTH_FOR_KEY \
+(MAX_REF_PARTS \
*(HA_KEY_NULL_LENGTH + HA_KEY_BLOB_LENGTH)))
#define HA_LEX_CREATE_TMP_TABLE 1
#define HA_LEX_CREATE_IF_NOT_EXISTS 2
#define HA_LEX_CREATE_TABLE_LIKE 4
@@ -3233,14 +3239,14 @@ public:
uint max_key_parts() const
{ return MY_MIN(MAX_REF_PARTS, max_supported_key_parts()); }
uint max_key_length() const
{ return MY_MIN(MAX_KEY_LENGTH, max_supported_key_length()); }
{ return MY_MIN(MAX_DATA_LENGTH_FOR_KEY, max_supported_key_length()); }
uint max_key_part_length() const
{ return MY_MIN(MAX_KEY_LENGTH, max_supported_key_part_length()); }
{ return MY_MIN(MAX_DATA_LENGTH_FOR_KEY, max_supported_key_part_length()); }
virtual uint max_supported_record_length() const { return HA_MAX_REC_LENGTH; }
virtual uint max_supported_keys() const { return 0; }
virtual uint max_supported_key_parts() const { return MAX_REF_PARTS; }
virtual uint max_supported_key_length() const { return MAX_KEY_LENGTH; }
virtual uint max_supported_key_length() const { return MAX_DATA_LENGTH_FOR_KEY; }
virtual uint max_supported_key_part_length() const { return 255; }
virtual uint min_record_length(uint options) const { return 1; }

4
sql/partition_info.cc
View File

@@ -1990,12 +1990,12 @@ bool partition_info::check_partition_field_length()
for (i= 0; i < num_part_fields; i++)
store_length+= get_partition_field_store_length(part_field_array[i]);
if (store_length > MAX_KEY_LENGTH)
if (store_length > MAX_DATA_LENGTH_FOR_KEY)
DBUG_RETURN(TRUE);
store_length= 0;
for (i= 0; i < num_subpart_fields; i++)
store_length+= get_partition_field_store_length(subpart_field_array[i]);
if (store_length > MAX_KEY_LENGTH)
if (store_length > MAX_DATA_LENGTH_FOR_KEY)
DBUG_RETURN(TRUE);
DBUG_RETURN(FALSE);
}

12
sql/sql_const.h
View File

@@ -33,7 +33,17 @@
#define MAX_SYS_VAR_LENGTH 32
#define MAX_KEY MAX_INDEXES /* Max used keys */
#define MAX_REF_PARTS 32 /* Max parts used as ref */
#define MAX_KEY_LENGTH 3072 /* max possible key */
/*
Maximum length of the data part of an index lookup key.
The "data part" is defined as the value itself, not including the
NULL-indicator bytes or varchar length bytes ("the Extras"). We need this
value because there was a bug where length of the Extras were not counted.
You probably need MAX_KEY_LENGTH, not this constant.
*/
#define MAX_DATA_LENGTH_FOR_KEY 3072
#if SIZEOF_OFF_T > 4
#define MAX_REFLENGTH 8 /* Max length for record ref */
#else

2
sql/table.cc
View File

@@ -1816,7 +1816,7 @@ int TABLE_SHARE::init_from_binary_frm_image(THD *thd, bool write,
uint pk_part_length= key_first_info->key_part[i].store_length;
if (keyinfo->ext_key_part_map & 1<<i)
{
if (ext_key_length + pk_part_length > MAX_KEY_LENGTH)
if (ext_key_length + pk_part_length > MAX_DATA_LENGTH_FOR_KEY)
{
add_keyparts_for_this_key= i;
break;