summaryrefslogtreecommitdiff
path: root/libmysql
diff options
context:
space:
mode:
authorunknown <serg@serg.mysql.com>2002-12-04 01:26:32 +0100
committerunknown <serg@serg.mysql.com>2002-12-04 01:26:32 +0100
commita31d258ba7c36c0ed27a5bed576dc430bc7219a6 (patch)
treebe17e269e852175b8b1f67c02a3528f2cc6c6cad /libmysql
parente753fa4d8d30976b0c4a7ca68bd81b3a11bba06b (diff)
downloadmariadb-git-a31d258ba7c36c0ed27a5bed576dc430bc7219a6.tar.gz
protect from [heap] buffer overrrun by malicious server
Diffstat (limited to 'libmysql')
-rw-r--r--libmysql/libmysql.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/libmysql/libmysql.c b/libmysql/libmysql.c
index bab6d304094..3c1353e0088 100644
--- a/libmysql/libmysql.c
+++ b/libmysql/libmysql.c
@@ -307,7 +307,7 @@ net_safe_read(MYSQL *mysql)
DBUG_PRINT("error",("Wrong connection or packet. fd: %s len: %d",
vio_description(net->vio),len));
end_server(mysql);
- net->last_errno=(net->last_errno == ER_NET_PACKET_TOO_LARGE ?
+ net->last_errno=(net->last_errno == ER_NET_PACKET_TOO_LARGE ?
CR_NET_PACKET_TOO_LARGE:
CR_SERVER_LOST);
strmov(net->last_error,ER(net->last_errno));
@@ -891,7 +891,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
uint field,pkt_len;
ulong len;
uchar *cp;
- char *to;
+ char *to, *end_to;
MYSQL_DATA *result;
MYSQL_ROWS **prev_ptr,*cur;
NET *net = &mysql->net;
@@ -929,6 +929,7 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
*prev_ptr=cur;
prev_ptr= &cur->next;
to= (char*) (cur->data+fields+1);
+ end_to=to+pkt_len-1;
for (field=0 ; field < fields ; field++)
{
if ((len=(ulong) net_field_length(&cp)) == NULL_LENGTH)
@@ -938,6 +939,13 @@ static MYSQL_DATA *read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
else
{
cur->data[field] = to;
+ if (to+len > end_to)
+ {
+ free_rows(result);
+ net->last_errno=CR_UNKNOWN_ERROR;
+ strmov(net->last_error,ER(net->last_errno));
+ DBUG_RETURN(0);
+ }
memcpy(to,(char*) cp,len); to[len]=0;
to+=len+1;
cp+=len;