diff options
| author | knielsen@mysql.com <> | 2006-06-23 14:50:02 +0200 |
|---|---|---|
| committer | knielsen@mysql.com <> | 2006-06-23 14:50:02 +0200 |
| commit | 98a5cdfe4cafb9e74d9d800e4b2979ac01765fab (patch) | |
| tree | eeaf89f3a45a849ee7fb1618b1c0daaeb956ba6d /mysys | |
| parent | 01046bb7569109190722ec5a1f3c2a8f8b52350d (diff) | |
| download | mariadb-git-98a5cdfe4cafb9e74d9d800e4b2979ac01765fab.tar.gz | |
BUG#20622: Fix one-byte buffer overrun in IM directory string handling.
The problem was a call to convert_dirname() with a destination buffer
that did not have room for the trailing slash added by that function.
This could cause the instance manager to crash in some cases.
Diffstat (limited to 'mysys')
| -rw-r--r-- | mysys/mf_dirname.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/mysys/mf_dirname.c b/mysys/mf_dirname.c index 9206aa28078..4d78f039799 100644 --- a/mysys/mf_dirname.c +++ b/mysys/mf_dirname.c @@ -72,7 +72,9 @@ uint dirname_part(my_string to, const char *name) SYNPOSIS convert_dirname() - to Store result here + to Store result here. Must be at least of size + min(FN_REFLEN, strlen(from) + 1) to make room + for adding FN_LIBCHAR at the end. from Original filename from_end Pointer at end of filename (normally end \0) |