database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-12-24 11:21:21 +03:00
Code Activity

BUG#58246: INSTALL PLUGIN not secure & crashable

Browse Source 
When installing plugins, there is a missing check
for slash (/) in the path on Windows. Note that on
Windows, both / and \ can be used to separate
directories.

This patch fixes the issue by:
- Adding a FN_DIRSEP symbol for all platforms
  consisting of a string of legal directory
  separators.
- Adding a charset-aware version of strcspn().
- Adding a check_valid_path() function that uses
  my_strcspn() to check if any FN_DIRSEP character
  is in the supplied string.
- Using the check_valid_path() function in
  sql_plugin.cc and sql_udf.cc (which means
  replacing the existing test there).
This commit is contained in:
Mats Kindahl
2010-12-01 13:54:50 +01:00
parent 80246ac8b8
commit 91a4a8aba6
10 changed files with 105 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
mysql-test/t/plugin_not_embedded.test
View File

@@ -18,3 +18,14 @@ UNINSTALL PLUGIN example;
disconnect con1;
connection default;
DROP USER bug51770@localhost;
#
# BUG#58246: INSTALL PLUGIN not secure & crashable
#
# The bug consisted of not recognizing / on Windows, so checking / on
# all platforms should cover this case.
let $path = `select CONCAT_WS('/', '..', $HA_EXAMPLE_SO)`;
--error ER_UDF_NO_PATHS
eval INSTALL PLUGIN example SONAME '$path';