database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-12-24 11:21:21 +03:00
Code Activity

BUG#14629727: USER_VAR_EVENT IS MISSING RANGE CHECKS

Browse Source 
Merge from mysql-5.1 into mysql-5.5.
This commit is contained in:
Nuno Carvalho
2012-10-12 08:36:09 +01:00
parent 614496d502 f1d3b0f190
commit 922792fdff
3 changed files with 86 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
sql/log_event.cc
View File

@@ -1299,7 +1299,7 @@ Log_event* Log_event::read_log_event(const char* buf, uint event_len,
ev = new Rand_log_event(buf, description_event);
break;
case USER_VAR_EVENT:
ev = new User_var_log_event(buf, description_event);
ev = new User_var_log_event(buf, event_len, description_event);
break;
case FORMAT_DESCRIPTION_EVENT:
ev = new Format_description_log_event(buf, event_len, description_event);
@@ -5812,19 +5812,35 @@ void User_var_log_event::pack_info(Protocol* protocol)
User_var_log_event::
User_var_log_event(const char* buf,
User_var_log_event(const char* buf, uint event_len,
const Format_description_log_event* description_event)
:Log_event(buf, description_event)
#ifndef MYSQL_CLIENT
, deferred(false)
#endif
{
bool error= false;
const char* buf_start= buf;
/* The Post-Header is empty. The Variable Data part begins immediately. */
const char *start= buf;
buf+= description_event->common_header_len +
description_event->post_header_len[USER_VAR_EVENT-1];
name_len= uint4korr(buf);
name= (char *) buf + UV_NAME_LEN_SIZE;
/*
We don't know yet is_null value, so we must assume that name_len
may have the bigger value possible, is_null= True and there is no
payload for val.
*/
if (0 == name_len ||
!valid_buffer_range<uint>(name_len, buf_start, name,
event_len - UV_VAL_IS_NULL))
{
error= true;
goto err;
}
buf+= UV_NAME_LEN_SIZE + name_len;
is_null= (bool) *buf;
flags= User_var_log_event::UNDEF_F; // defaults to UNDEF_F
@@ -5837,6 +5853,14 @@ User_var_log_event(const char* buf,
}
else
{
if (!valid_buffer_range<uint>(UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE
+ UV_CHARSET_NUMBER_SIZE + UV_VAL_LEN_SIZE,
buf_start, buf, event_len))
{
error= true;
goto err;
}
type= (Item_result) buf[UV_VAL_IS_NULL];
charset_number= uint4korr(buf + UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE);
val_len= uint4korr(buf + UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE +
@@ -5844,6 +5868,12 @@ User_var_log_event(const char* buf,
val= (char *) (buf + UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE +
UV_CHARSET_NUMBER_SIZE + UV_VAL_LEN_SIZE);
if (!valid_buffer_range<uint>(val_len, buf_start, val, event_len))
{
error= true;
goto err;
}
/**
We need to check if this is from an old server
that did not pack information for flags.
@@ -5865,6 +5895,10 @@ User_var_log_event(const char* buf,
val_len);
}
}
err:
if (error)
name= 0;
}
@@ -6014,8 +6048,9 @@ void User_var_log_event::print(FILE* file, PRINT_EVENT_INFO* print_event_info)
char *hex_str;
CHARSET_INFO *cs;
if (!(hex_str= (char *)my_alloca(2*val_len+1+2))) // 2 hex digits / byte
break; // no error, as we are 'void'
hex_str= (char *)my_malloc(2*val_len+1+2,MYF(MY_WME)); // 2 hex digits / byte
if (!hex_str)
return;
str_to_hex(hex_str, val, val_len);
/*
For proper behaviour when mysqlbinlog|mysql, we need to explicitely
@@ -6033,7 +6068,7 @@ void User_var_log_event::print(FILE* file, PRINT_EVENT_INFO* print_event_info)
my_b_printf(&cache, ":=_%s %s COLLATE `%s`%s\n",
cs->csname, hex_str, cs->name,
print_event_info->delimiter);
my_afree(hex_str);
my_free(hex_str);
}
break;
case ROW_RESULT:

4
sql/log_event.h
View File

@@ -2577,7 +2577,7 @@ public:
void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
#endif
User_var_log_event(const char* buf,
User_var_log_event(const char* buf, uint event_len,
const Format_description_log_event *description_event);
~User_var_log_event() {}
Log_event_type get_type_code() { return USER_VAR_EVENT;}
@@ -2591,7 +2591,7 @@ public:
bool is_deferred() { return deferred; }
void set_deferred() { deferred= true; }
#endif
bool is_valid() const { return 1; }
bool is_valid() const { return name != 0; }
private:
#if defined(MYSQL_SERVER) && defined(HAVE_REPLICATION)

44
sql/sql_priv.h
View File

@@ -151,6 +151,50 @@
*/
#define OPTION_ALLOW_BATCH (ULL(1) << 36) // THD, intern (slave)
/*
Check how many bytes are available on buffer.
@param buf_start Pointer to buffer start.
@param buf_current Pointer to the current position on buffer.
@param buf_len Buffer length.
@return Number of bytes available on event buffer.
*/
template <class T> T available_buffer(const char* buf_start,
const char* buf_current,
T buf_len)
{
return buf_len - (buf_current - buf_start);
}
/* Explicit instantion to unsigned int. */
template unsigned int available_buffer<unsigned int>(const char*,
const char*,
unsigned int);
/*
Check if jump value is within buffer limits.
@param jump Number of positions we want to advance.
@param buf_start Pointer to buffer start
@param buf_current Pointer to the current position on buffer.
@param buf_len Buffer length.
@return True If jump value is within buffer limits.
False Otherwise.
*/
template <class T> bool valid_buffer_range(T jump,
const char* buf_start,
const char* buf_current,
T buf_len)
{
return (jump <= available_buffer(buf_start, buf_current, buf_len));
}
/* Explicit instantion to unsigned int. */
template bool valid_buffer_range<unsigned int>(unsigned int,
const char*,
const char*,
unsigned int);
/* The rest of the file is included in the server only */
#ifndef MYSQL_CLIENT