InnoDB: Fix potential buffer underflow.

innobase/include/ut0mem.h:
  Add ut_strlcpy_rev.
innobase/mem/mem0mem.c:
  Use ut_strlcpy_rev instead of buggy own implementation.
innobase/ut/ut0mem.c:
  Add ut_strlcpy_rev.

1 files changed, 13 insertions, 0 deletions

diff --git a/innobase/include/ut0mem.h b/innobase/include/ut0mem.h
index 8f109a64b55..b9bbe0b5c92 100644
--- a/innobase/include/ut0mem.h
+++ b/innobase/include/ut0mem.h
@@ -122,6 +122,7 @@ ut_strcmp(const void* str1, const void* str2);
 Copies up to size - 1 characters from the NUL-terminated string src to
 dst, NUL-terminating the result. Returns strlen(src), so truncation
 occurred if the return value >= size. */
+
 ulint
 ut_strlcpy(
 /*=======*/
@@ -131,6 +132,18 @@ ut_strlcpy(
 	ulint		size);	/* in: size of destination buffer */
 
 /**************************************************************************
+Like ut_strlcpy, but if src doesn't fit in dst completely, copies the last
+(size - 1) bytes of src, not the first. */
+
+ulint
+ut_strlcpy_rev(
+/*===========*/
+				/* out: strlen(src) */
+	char*		dst,	/* in: destination buffer */
+	const char*	src,	/* in: source buffer */
+	ulint		size);	/* in: size of destination buffer */
+
+/**************************************************************************
 Compute strlen(ut_strcpyq(str, q)). */
 UNIV_INLINE
 ulint