database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-12-24 11:21:21 +03:00
Code Activity

Cherry-pick fix for Bug#53371, security hole with bypassing grants using special path in db/table names.

Browse Source 
Bump MariaDB version for security fix release.
This commit is contained in:
unknown
2010-05-09 21:30:06 +02:00
parent 07bfc5a2d6
commit fcfb218f71
10 changed files with 130 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
sql/sql_parse.cc
View File

@@ -1334,6 +1334,11 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
system_charset_info, packet, db_length,
thd->charset(), &dummy_errors);
db_buff[db_length]= '\0';
if (check_table_name(db_buff, db_length, FALSE))
{
my_error(ER_WRONG_TABLE_NAME, MYF(0), db_buff);
break;
}
table_list.alias= table_list.table_name= db_buff;
if (!(fields= (char *) thd->memdup(wildcard, query_length + 1)))
break;
@@ -6298,7 +6303,7 @@ TABLE_LIST *st_select_lex::add_table_to_list(THD *thd,
DBUG_RETURN(0); // End of memory
alias_str= alias ? alias->str : table->table.str;
if (!test(table_options & TL_OPTION_ALIAS) &&
check_table_name(table->table.str, table->table.length))
check_table_name(table->table.str, table->table.length, FALSE))
{
my_error(ER_WRONG_TABLE_NAME, MYF(0), table->table.str);
DBUG_RETURN(0);