database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-27 18:02:13 +03:00
Code Activity

Bug#31588: buffer overrun when setting variables

Browse Source 
Buffer used when setting variables was not dimensioned to accomodate
trailing '\0'. An overflow by one character was therefore possible.
CS corrects limits to prevent such overflows.


mysql-test/r/variables.result:
  Try to overflow buffer used for setting system variables.
  Unpatched server should throw a valgrind warning here.
  Actual value and error message irrelevant, only length counts.
mysql-test/t/variables.test:
  Try to overflow buffer used for setting system variables.
sql/set_var.cc:
  Adjust maximum number of characters we can store in 'buff' by one
  as strmake() will write a terminating '\0'.
This commit is contained in:
unknown
2007-10-18 10:47:54 +02:00
parent 77d786b5a0
commit cd9d89a75d
3 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
mysql-test/t/variables.test
View File

@ -447,4 +447,11 @@ set @test = @@query_prealloc_size;
set @@query_prealloc_size = @test;
select @@query_prealloc_size = @test;
# End of 4.1 tests
#
# Bug#31588 buffer overrun when setting variables
#
# Buffer-size Off By One. Should throw valgrind-warning without fix #31588.
--error 1231
set global sql_mode=repeat('a',80);
--echo End of 4.1 tests