Merge with 4.0.6

2 files changed, 20 insertions, 9 deletions

diff --git a/libmysql/errmsg.c b/libmysql/errmsg.c
index bfd253728ce..2eecb5c2afd 100644
--- a/libmysql/errmsg.c
+++ b/libmysql/errmsg.c
@@ -51,7 +51,7 @@ const char *client_errors[]=
   "Error connecting to slave:",
   "Error connecting to master:",
   "SSL connection error",
-  "Invalid connection handle",
+  "Malformed packet",
   "Invalid use of null pointer",
   "Statement not prepared",
   "Not all parameters data supplied",
@@ -70,7 +70,8 @@ const char *client_errors[]=
   "Can't open shared memory. %s event don't create for client (%lu)",
   "Can't open shared memory. Server abandoded and don't sent the answer event (%lu)",
   "Can't open shared memory. Can't send the request event to server (%lu)",
-  "Wrong or unknown protocol"
+  "Wrong or unknown protocol",
+  "Invalid connection handle"
 };
 
 /* Start of code added by Roberto M. Serqueira - martinsc@uol.com.br - 05.24.2001 */
@@ -83,7 +84,7 @@ const char *client_errors[]=
   "Não pode se conectar ao servidor MySQL local através do 'socket' '%-.64s' (%d)", 
   "Não pode se conectar ao servidor MySQL em '%-.64s' (%d)",
   "Não pode criar 'socket TCP/IP' (%d)",
-  "'Host' servidor MySQL '%-.64s' (%d) desconhecido", 
+  "'Host' servidor MySQL '%-.64s' (%d) desconhecido",
   "Servidor MySQL desapareceu",
   "Incompatibilidade de protocolos. Versão do Servidor: %d - Versão do Cliente: %d",
   "Cliente do MySQL com falta de memória",
@@ -105,7 +106,7 @@ const char *client_errors[]=
   "Error connecting to slave:",
   "Error connecting to master:",
   "SSL connection error",
-  "Invalid connection handle",
+  "Malformed packet",
   "Invalid use of null pointer",
   "Statement not prepared",
   "Not all parameters data supplied",
@@ -124,7 +125,8 @@ const char *client_errors[]=
   "Can't open shared memory. %s event don't create for client (%lu)",
   "Can't open shared memory. Server abandoded and don't sent the answer event (%lu)",
   "Can't open shared memory. Can't send the request event to server (%lu)",
-  "Wrong or unknown protocol"
+  "Wrong or unknown protocol",
+  "Invalid connection handle"
 };
 
 #else /* ENGLISH */
@@ -157,7 +159,7 @@ const char *client_errors[]=
   "Error connecting to slave:",
   "Error connecting to master:",
   "SSL connection error",
-  "Invalid connection handle",
+  "Malformed packet",
   "Invalid use of null pointer",
   "Statement not prepared",
   "Not all parameters data supplied",
@@ -176,7 +178,8 @@ const char *client_errors[]=
   "Can't open shared memory. %s event don't create for client (%lu)",
   "Can't open shared memory. Server abandoded and don't sent the answer event (%lu)",
   "Can't open shared memory. Can't send the request event to server (%lu)",
-  "Wrong or unknown protocol"
+  "Wrong or unknown protocol",
+  "Invalid connection handle"
 };
 #endif
 
diff --git a/libmysql/libmysql.c b/libmysql/libmysql.c
index 94a32477c83..1e33bbb6a93 100644
--- a/libmysql/libmysql.c
+++ b/libmysql/libmysql.c
@@ -554,7 +554,7 @@ net_safe_read(MYSQL *mysql)
     DBUG_PRINT("error",("Wrong connection or packet. fd: %s  len: %d",
 			vio_description(net->vio),len));
     end_server(mysql);
-    net->last_errno=(net->last_errno == ER_NET_PACKET_TOO_LARGE ? 
+    net->last_errno=(net->last_errno == ER_NET_PACKET_TOO_LARGE ?
 		     CR_NET_PACKET_TOO_LARGE:
 		     CR_SERVER_LOST);
     strmov(net->last_error,ER(net->last_errno));
@@ -1196,7 +1196,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
   ulong pkt_len;
   ulong len;
   uchar *cp;
-  char	*to;
+  char	*to, *end_to;
   MYSQL_DATA *result;
   MYSQL_ROWS **prev_ptr,*cur;
   NET *net = &mysql->net;
@@ -1242,6 +1242,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
     *prev_ptr=cur;
     prev_ptr= &cur->next;
     to= (char*) (cur->data+fields+1);
+    end_to=to+pkt_len-1;
     for (field=0 ; field < fields ; field++)
     {
       if ((len=(ulong) net_field_length(&cp)) == NULL_LENGTH)
@@ -1251,6 +1252,13 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
       else
       {
 	cur->data[field] = to;
+        if (to+len > end_to)
+        {
+          free_rows(result);
+          net->last_errno=CR_MALFORMED_PACKET;
+          strmov(net->last_error,ER(net->last_errno));
+          DBUG_RETURN(0);
+        }
 	memcpy(to,(char*) cp,len); to[len]=0;
 	to+=len+1;
 	cp+=len;