database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-27 18:02:13 +03:00
Code Activity

Bug#48983: Bad strmake calls (length one too long)

Browse Source 
The problem is a somewhat common misusage of the strmake function.
The strmake(dst, src, len) function writes at most /len/ bytes to
the string pointed to by src, not including the trailing null byte.
Hence, if /len/ is the exact length of the destination buffer, a
one byte buffer overflow can occur if the length of the source
string is equal to or greater than /len/.
This commit is contained in:
Davi Arnaut
2009-12-17 15:58:38 -02:00
parent 0f73979084
commit b9380f0e76
12 changed files with 22 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sql/log.cc
View File

@ -501,7 +501,7 @@ const char *MYSQL_LOG::generate_name(const char *log_name,
{
char *p = fn_ext(log_name);
uint length=(uint) (p-log_name);
strmake(buff,log_name,min(length,FN_REFLEN));
strmake(buff, log_name, min(length, FN_REFLEN-1));
return (const char*)buff;
}
return log_name;
@ -1503,7 +1503,7 @@ int MYSQL_LOG::purge_logs_before_date(time_t purge_time)
if (stat_area.st_mtime < purge_time)
strmake(to_log,
log_info.log_file_name,
sizeof(log_info.log_file_name));
sizeof(log_info.log_file_name) - 1);
else
break;
}
@ -2604,11 +2604,11 @@ bool flush_error_log()
if (opt_error_log)
{
char err_renamed[FN_REFLEN], *end;
end= strmake(err_renamed,log_error_file,FN_REFLEN-4);
end= strmake(err_renamed,log_error_file,FN_REFLEN-5);
strmov(end, "-old");
VOID(pthread_mutex_lock(&LOCK_error_log));
#ifdef __WIN__
char err_temp[FN_REFLEN+4];
char err_temp[FN_REFLEN+5];
/*
On Windows is necessary a temporary file for to rename
the current error file.