diff options
| author | mithun <mithun.c.y@oracle.com> | 2013-09-10 15:32:27 +0530 |
|---|---|---|
| committer | mithun <mithun.c.y@oracle.com> | 2013-09-10 15:32:27 +0530 |
| commit | d88c01d3ffe69d9b60e12f7c271470bc1bc1980d (patch) | |
| tree | 412cd34929aa911dbb793224719de41da89aaf15 /mysys | |
| parent | 9e91f479d253052e4514cffd0699ef72bcce82a6 (diff) | |
| download | mariadb-git-d88c01d3ffe69d9b60e12f7c271470bc1bc1980d.tar.gz | |
Bug #16978278 : BUFFER OVERFLOW WHEN PRINTING A LARGE 64-BIT INTEGER
WITH MY_B_VPRINTF()
Issue : In LP 64 machine max long value can be 20 digit
decimal value. But in my_b_vprintf() the intermediate
buffer storage used is 17 bytes length. This will lead to
buffer overflow.
Solution : Increased the buffer storage from 17 to 32 bytes.
code is backported from 5.6
Diffstat (limited to 'mysys')
| -rw-r--r-- | mysys/mf_iocache2.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/mysys/mf_iocache2.c b/mysys/mf_iocache2.c index eaa70782f16..f65ca97bd16 100644 --- a/mysys/mf_iocache2.c +++ b/mysys/mf_iocache2.c @@ -415,7 +415,7 @@ process_flags: { register int iarg; size_t length2; - char buff[17]; + char buff[32]; iarg = va_arg(args, int); if (*fmt == 'd') @@ -450,7 +450,7 @@ process_flags: { register long iarg; size_t length2; - char buff[17]; + char buff[32]; iarg = va_arg(args, long); if (*++fmt == 'd') |