summaryrefslogtreecommitdiff
path: root/extra
diff options
context:
space:
mode:
authorHugo Wen <wenhug@amazon.com>2023-02-23 23:56:44 +0000
committerDaniel Black <daniel@mariadb.org>2023-03-02 14:38:24 +1100
commit7bdd878ae40e19b69736ed01fd2bc861c83d1784 (patch)
treee0f07826dc9072a40dbcda3654736458ab1a92ab /extra
parentacfb5dfd973e0b63090a32bbf90f380317192ab5 (diff)
downloadmariadb-git-7bdd878ae40e19b69736ed01fd2bc861c83d1784.tar.gz
Fix few vulnerabilities found by Cppcheck
While performing SAST scanning using Cppcheck against source code of commit 81196469, several code vulnerabilities were found. Fix following issues: 1. Parameters of `snprintf` function are incorrect. Cppcheck error: client/mysql_plugin.c:1228: error: snprintf format string requires 6 parameters but only 5 are given. It is due to commit 630d7229 introduced option `--lc-messages-dir` in the bootstrap command. However the parameter was not even given in the `snprintf` after changing the format string. Fix: Restructure the code logic and correct the function parameters for `snprintf`. 2. Null pointer is used in a `snprintf` which could cause a crash. Cppcheck error: extra/mariabackup/xbcloud.cc:2534: error: Null pointer dereference The code intended to print the swift_project name, if the opt_swift_project_id is NULL but opt_swift_project is not NULL. However the parameter of `snprintf` was mistakenly using `opt_swift_project_id`. Fix: Change to use the correct string from `opt_swift_project`. 3. Potential double release of a memory Cppcheck error: plugin/auth_pam/testing/pam_mariadb_mtr.c:69: error: Memory pointed to by 'resp' is freed twice. A pointer `resp` is reused and allocated new memory after it has been freed. However, `resp` was not set to NULL after freed. Potential double release of the same pointer if the call back function doesn't allocate new memory for `resp` pointer. Fix: Set the `resp` pointer to NULL after the first free() to make sure the same address is not freed twice. All new code of the whole pull request, including one or several files that are either new files or modified ones, are contributed under the BSD-new license. I am contributing on behalf of my employer Amazon Web Services, Inc.
Diffstat (limited to 'extra')
-rw-r--r--extra/mariabackup/xbcloud.cc2
1 files changed, 1 insertions, 1 deletions
diff --git a/extra/mariabackup/xbcloud.cc b/extra/mariabackup/xbcloud.cc
index cee76e5f3d7..588a15eb791 100644
--- a/extra/mariabackup/xbcloud.cc
+++ b/extra/mariabackup/xbcloud.cc
@@ -2534,7 +2534,7 @@ swift_keystone_auth_v3(const char *auth_url, swift_auth_info *info)
} else if (opt_swift_project != NULL) {
snprintf(scope, sizeof(scope),
",\"scope\":{\"project\":{\"name\":\"%s\"%s}}",
- opt_swift_project_id, domain);
+ opt_swift_project, domain);
}
snprintf(payload, sizeof(payload), "{\"auth\":{\"identity\":"