diff options
| author | Harin Vadodaria <harin.vadodaria@oracle.com> | 2015-11-06 16:41:55 +0530 |
|---|---|---|
| committer | Harin Vadodaria <harin.vadodaria@oracle.com> | 2015-11-06 16:41:55 +0530 |
| commit | 0dbd5a8797ed4bd18e8b883988fb62177eb0f73f (patch) | |
| tree | 1bab2534ca81a99100fa6ed3edcd8111a058d25f /client/mysql_plugin.c | |
| parent | fd9831410dfc878420fcd95dc576b955e94d2c76 (diff) | |
| download | mariadb-git-0dbd5a8797ed4bd18e8b883988fb62177eb0f73f.tar.gz | |
Bug#21973610: BUFFER OVERFLOW ISSUES
Description : Incorrect usage of sprintf/strcpy caused
possible buffer overflow issues at various
places.
Solution : - Fixed mysql_plugin and mysqlshow
- Fixed regex library issues
Reviewed-By : Georgi Kodinov <georgi.kodinov@oracle.com>
Reviewed-By : Venkata S Murthy Sidagam <venkata.sidagam@oracle.com>
Diffstat (limited to 'client/mysql_plugin.c')
| -rw-r--r-- | client/mysql_plugin.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/client/mysql_plugin.c b/client/mysql_plugin.c index cf212b16f24..293bd6727cf 100644 --- a/client/mysql_plugin.c +++ b/client/mysql_plugin.c @@ -1,5 +1,5 @@ /* - Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved. + Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -406,7 +406,7 @@ exit: static void usage(void) { PRINT_VERSION; - puts("Copyright (c) 2011, Oracle and/or its affiliates. " + puts("Copyright (c) 2011, 2015, Oracle and/or its affiliates. " "All rights reserved.\n"); puts("Enable or disable plugins."); printf("\nUsage: %s [options] <plugin> ENABLE|DISABLE\n\nOptions:\n", @@ -757,6 +757,11 @@ static int check_options(int argc, char **argv, char *operation) /* read the plugin config file and check for match against argument */ else { + if (strlen(argv[i]) + 4 + 1 > FN_REFLEN) + { + fprintf(stderr, "ERROR: argument is too long.\n"); + return 1; + } strcpy(plugin_name, argv[i]); strcpy(config_file, argv[i]); strcat(config_file, ".ini"); @@ -848,6 +853,7 @@ static int process_options(int argc, char *argv[], char *operation) if (opt_basedir[i-1] != FN_LIBCHAR || opt_basedir[i-1] != FN_LIBCHAR2) { char buff[FN_REFLEN]; + memset(buff, 0, sizeof(buff)); strncpy(buff, opt_basedir, sizeof(buff) - 1); #ifdef __WIN__ |