diff options
| author | unknown <knielsen@mysql.com> | 2006-06-23 14:50:02 +0200 |
|---|---|---|
| committer | unknown <knielsen@mysql.com> | 2006-06-23 14:50:02 +0200 |
| commit | 0f3cc95bf1523754d21cc3a4c59c0d107adc1c16 (patch) | |
| tree | eeaf89f3a45a849ee7fb1618b1c0daaeb956ba6d /mysys/mf_dirname.c | |
| parent | 39246e2fa75c9ebb0001907e650d960b71e68220 (diff) | |
| download | mariadb-git-0f3cc95bf1523754d21cc3a4c59c0d107adc1c16.tar.gz | |
BUG#20622: Fix one-byte buffer overrun in IM directory string handling.
The problem was a call to convert_dirname() with a destination buffer
that did not have room for the trailing slash added by that function.
This could cause the instance manager to crash in some cases.
mysys/mf_dirname.c:
Clarify in comments that convert_dirname destination must be larger than
source to accomodate a trailing slash.
server-tools/instance-manager/instance_options.cc:
Fix buffer overrun.
Diffstat (limited to 'mysys/mf_dirname.c')
| -rw-r--r-- | mysys/mf_dirname.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/mysys/mf_dirname.c b/mysys/mf_dirname.c index 9206aa28078..4d78f039799 100644 --- a/mysys/mf_dirname.c +++ b/mysys/mf_dirname.c @@ -72,7 +72,9 @@ uint dirname_part(my_string to, const char *name) SYNPOSIS convert_dirname() - to Store result here + to Store result here. Must be at least of size + min(FN_REFLEN, strlen(from) + 1) to make room + for adding FN_LIBCHAR at the end. from Original filename from_end Pointer at end of filename (normally end \0) |