Merge 10.2 into 10.3

1 files changed, 60 insertions, 9 deletions

diff --git a/plugin/server_audit/server_audit.c b/plugin/server_audit/server_audit.c
index c655e02a4fc..801718265ad 100644
--- a/plugin/server_audit/server_audit.c
+++ b/plugin/server_audit/server_audit.c
@@ -15,7 +15,7 @@
 
 
 #define PLUGIN_VERSION 0x104
-#define PLUGIN_STR_VERSION "1.4.4"
+#define PLUGIN_STR_VERSION "1.4.5"
 
 #define _my_thread_var loc_thread_var
 
@@ -333,6 +333,10 @@ static void update_file_rotations(MYSQL_THD thd, struct st_mysql_sys_var *var,
                                   void *var_ptr, const void *save);
 static void update_incl_users(MYSQL_THD thd, struct st_mysql_sys_var *var,
                               void *var_ptr, const void *save);
+static int check_incl_users(MYSQL_THD thd, struct st_mysql_sys_var *var, void *save,
+                            struct st_mysql_value *value);
+static int check_excl_users(MYSQL_THD thd, struct st_mysql_sys_var *var, void *save,
+                            struct st_mysql_value *value);
 static void update_excl_users(MYSQL_THD thd, struct st_mysql_sys_var *var,
                               void *var_ptr, const void *save);
 static void update_output_type(MYSQL_THD thd, struct st_mysql_sys_var *var,
@@ -352,10 +356,10 @@ static void rotate_log(MYSQL_THD thd, struct st_mysql_sys_var *var,
 
 static MYSQL_SYSVAR_STR(incl_users, incl_users, PLUGIN_VAR_RQCMDARG,
        "Comma separated list of users to monitor.",
-       NULL, update_incl_users, NULL);
+       check_incl_users, update_incl_users, NULL);
 static MYSQL_SYSVAR_STR(excl_users, excl_users, PLUGIN_VAR_RQCMDARG,
        "Comma separated list of users to exclude from auditing.",
-       NULL, update_excl_users, NULL);
+       check_excl_users, update_excl_users, NULL);
 /* bits in the event filter. */
 #define EVENT_CONNECT 1
 #define EVENT_QUERY_ALL 2
@@ -1621,7 +1625,7 @@ static int log_statement_ex(const struct connection_info *cn,
   }
 
   if (query && !(events & EVENT_QUERY_ALL) &&
-      (events & EVENT_QUERY))
+      (events & EVENT_QUERY && !cn->log_always))
   {
     const char *orig_query= query;
 
@@ -2555,9 +2559,10 @@ static void log_current_query(MYSQL_THD thd)
   if (!ci_needs_setup(cn) && cn->query_length &&
       FILTER(EVENT_QUERY) && do_log_user(cn->user))
   {
+    cn->log_always= 1;
     log_statement_ex(cn, cn->query_time, thd_get_thread_id(thd),
         cn->query, cn->query_length, 0, "QUERY");
-    cn->log_always= 1;
+    cn->log_always= 0;
   }
 }
 
@@ -2646,16 +2651,56 @@ static void update_file_rotate_size(MYSQL_THD thd  __attribute__((unused)),
 }
 
 
+static int check_users(void *save, struct st_mysql_value *value,
+                       size_t s, const char *name)
+{
+  const char *users;
+  int len= 0;
+
+  users= value->val_str(value, NULL, &len);
+  if ((size_t) len > s)
+  {
+    error_header();
+    fprintf(stderr,
+            "server_audit_%s_users value can't be longer than %zu characters.\n",
+            name, s);
+    return 1;
+  }
+  *((const char**)save)= users;
+  return 0;
+}
+
+static int check_incl_users(MYSQL_THD thd  __attribute__((unused)),
+                            struct st_mysql_sys_var *var  __attribute__((unused)),
+                            void *save, struct st_mysql_value *value)
+{
+  return check_users(save, value, sizeof(incl_user_buffer), "incl");
+}
+
+static int check_excl_users(MYSQL_THD thd  __attribute__((unused)),
+                            struct st_mysql_sys_var *var  __attribute__((unused)),
+                            void *save, struct st_mysql_value *value)
+{
+  return check_users(save, value, sizeof(excl_user_buffer), "excl");
+}
+
+
 static void update_incl_users(MYSQL_THD thd,
               struct st_mysql_sys_var *var  __attribute__((unused)),
               void *var_ptr  __attribute__((unused)), const void *save)
 {
   char *new_users= (*(char **) save) ? *(char **) save : empty_str;
+  size_t new_len= strlen(new_users) + 1;
   if (!maria_55_started || !debug_server_started)
     flogger_mutex_lock(&lock_operations);
   mark_always_logged(thd);
-  strncpy(incl_user_buffer, new_users, sizeof(incl_user_buffer)-1);
-  incl_user_buffer[sizeof(incl_user_buffer)-1]= 0;
+
+  if (new_len > sizeof(incl_user_buffer))
+    new_len= sizeof(incl_user_buffer);
+
+  memcpy(incl_user_buffer, new_users, new_len - 1);
+  incl_user_buffer[new_len - 1]= 0;
+
   incl_users= incl_user_buffer;
   user_coll_fill(&incl_user_coll, incl_users, &excl_user_coll, 1);
   error_header();
@@ -2670,11 +2715,17 @@ static void update_excl_users(MYSQL_THD thd  __attribute__((unused)),
               void *var_ptr  __attribute__((unused)), const void *save)
 {
   char *new_users= (*(char **) save) ? *(char **) save : empty_str;
+  size_t new_len= strlen(new_users) + 1;
   if (!maria_55_started || !debug_server_started)
     flogger_mutex_lock(&lock_operations);
   mark_always_logged(thd);
-  strncpy(excl_user_buffer, new_users, sizeof(excl_user_buffer)-1);
-  excl_user_buffer[sizeof(excl_user_buffer)-1]= 0;
+
+  if (new_len > sizeof(excl_user_buffer))
+    new_len= sizeof(excl_user_buffer);
+
+  memcpy(excl_user_buffer, new_users, new_len - 1);
+  excl_user_buffer[new_len - 1]= 0;
+
   excl_users= excl_user_buffer;
   user_coll_fill(&excl_user_coll, excl_users, &incl_user_coll, 0);
   error_header();