database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

Bug#30689251 - BACKPORT TO MYSQL-5.6, BUG#29597896 - NULL POINTER DEREFERENCE IN LIBMYSQL

Browse Source 
DESCRIPTION:
============
There can be issues if the packets sent by the server
are not proper. Certain checks should be performed at the
client side while unpacking fields data.

FIX:
====
Check for the appropriate fields data and error out if it
is not present.

RB: 23601
This commit is contained in:
Anushree Prakash B
2019-12-26 16:29:04 +05:30
committed by Sergei Golubchik
parent 39c60116e8
commit e8e67bd4a4
1 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
sql-common/client.c
View File

@ -1538,9 +1538,23 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
{
if (field - result >= fields)
goto err;
/*
If any of the row->data[] below is NULL, it can result in a
crash. Error out early as it indicates a malformed packet.
For data[0], data[1] and data[5], strmake_root will handle
NULL values.
*/
if (!row->data[2] || !row->data[3] || !row->data[4])
{
free_rows(data);
set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate);
DBUG_RETURN(0);
}
cli_fetch_lengths(&lengths[0], row->data, default_value ? 6 : 5);
field->org_table= field->table= strdup_root(alloc,(char*) row->data[0]);
field->name= strdup_root(alloc,(char*) row->data[1]);
field->org_table= field->table= strmake_root(alloc,(char*) row->data[0], lengths[0]);
field->name= strmake_root(alloc,(char*) row->data[1], lengths[1]);
field->length= (uint) uint3korr(row->data[2]);
field->type= (enum enum_field_types) (uchar) row->data[3][0];
@ -1565,7 +1579,7 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
field->flags|= NUM_FLAG;
if (default_value && row->data[5])
{
field->def=strdup_root(alloc,(char*) row->data[5]);
field->def= strmake_root(alloc,(char*) row->data[5], lengths[5]);
field->def_length= lengths[5];
}
else