mirror of
https://github.com/MariaDB/server.git
synced 2025-10-28 17:15:19 +03:00
1b8322c3c6
old_password() functions The PASSWORD() and OLD_PASSWORD() functions could lead to memory reads outside of an internal buffer when used with BLOB arguments. String::c_ptr() assumes there is at least one extra byte in the internally allocated buffer when adding the trailing '\0'. This, however, may not be the case when a String object was initialized with externally allocated buffer. The bug was fixed by adding an additional "length" argument to make_scrambled_password_323() and make_scrambled_password() in order to avoid String::c_ptr() calls for PASSWORD()/OLD_PASSWORD(). However, since the make_scrambled_password[_323] functions are a part of the client library ABI, the functions with the new interfaces were implemented with the 'my_' prefix in their names, with the old functions changed to be wrappers around the new ones to maintain interface compatibility. mysql-test/r/func_crypt.result: Added a test case for bug #44767. mysql-test/t/func_crypt.test: Added a test case for bug #44767. sql/item_strfunc.cc: Use the new my_make_scrambled_password*() to avoid String::c_ptr(). sql/item_strfunc.h: Changed Item_func[_old]_password::alloc() interfaces so that we can use the new my_make_scrambled_password*() functions. sql/mysql_priv.h: Added declarations for the new my_make_scrambled_password*() functions. sql/password.c: Added new my_make_scrambled_password*() functions with an additional "length" argument. Changed ones to be wrappers around the new ones to maintain interface compatibility. sql/sql_yacc.yy: Utilize the new password hashing functions with additional length argument.
71 lines
1.8 KiB
Plaintext
71 lines
1.8 KiB
Plaintext
-- source include/have_crypt.inc
|
|
|
|
--disable_warnings
|
|
drop table if exists t1;
|
|
--enable_warnings
|
|
|
|
select length(encrypt('foo', 'ff')) <> 0;
|
|
--replace_result $1$aa$4OSUA5cjdx0RUQ08opV27/ aaqPiZY5xR5l.
|
|
|
|
create table t1 (name varchar(50), pw varchar(64));
|
|
insert into t1 values ('tom', password('my_pass'));
|
|
set @pass='my_pass';
|
|
select name from t1 where name='tom' and pw=password(@pass);
|
|
select name from t1 where name='tom' and pw=password(@undefined);
|
|
drop table t1;
|
|
|
|
# Test new and old password handling functions
|
|
|
|
select password('abc');
|
|
select password('');
|
|
select old_password('abc');
|
|
select old_password('');
|
|
select password('gabbagabbahey');
|
|
select old_password('idkfa');
|
|
select length(password('1'));
|
|
select length(encrypt('test'));
|
|
select encrypt('test','aa');
|
|
select old_password(NULL);
|
|
select password(NULL);
|
|
set global old_passwords=on;
|
|
select password('');
|
|
select old_password('');
|
|
select password('idkfa');
|
|
select old_password('idkfa');
|
|
set old_passwords=on;
|
|
select password('idkfa');
|
|
select old_password('idkfa');
|
|
set global old_passwords=off;
|
|
select password('idkfa');
|
|
select old_password('idkfa');
|
|
|
|
# this test shows that new scrambles honor spaces in passwords:
|
|
set old_passwords=off;
|
|
select password('idkfa ');
|
|
select password('idkfa');
|
|
select password(' idkfa');
|
|
select old_password('idkfa');
|
|
select old_password(' i d k f a ');
|
|
|
|
explain extended select password('idkfa '), old_password('idkfa');
|
|
|
|
#
|
|
# Bug #13619: Crash on FreeBSD with salt like '_.'
|
|
#
|
|
--replace_column 1 #
|
|
select encrypt('1234','_.');
|
|
|
|
# End of 4.1 tests
|
|
|
|
--echo #
|
|
--echo # Bug #44767: invalid memory reads in password() and old_password()
|
|
--echo # functions
|
|
--echo #
|
|
|
|
CREATE TABLE t1(c1 MEDIUMBLOB);
|
|
INSERT INTO t1 VALUES (REPEAT('a', 1024));
|
|
SELECT OLD_PASSWORD(c1), PASSWORD(c1) FROM t1;
|
|
DROP TABLE t1;
|
|
|
|
--echo End of 5.0 tests
|