diff options
| author | Davi Arnaut <Davi.Arnaut@Sun.COM> | 2009-12-17 15:58:38 -0200 |
|---|---|---|
| committer | Davi Arnaut <Davi.Arnaut@Sun.COM> | 2009-12-17 15:58:38 -0200 |
| commit | 06a1df91813ea2c39f7312bcf8af972c7e8a926f (patch) | |
| tree | dac324abc82ad6d66e71348f8270ff42658c84a9 /server-tools | |
| parent | 522c084631ad581ec8f17b187a689f9b992ca06e (diff) | |
| download | mariadb-git-06a1df91813ea2c39f7312bcf8af972c7e8a926f.tar.gz | |
Bug#48983: Bad strmake calls (length one too long)
The problem is a somewhat common misusage of the strmake function.
The strmake(dst, src, len) function writes at most /len/ bytes to
the string pointed to by src, not including the trailing null byte.
Hence, if /len/ is the exact length of the destination buffer, a
one byte buffer overflow can occur if the length of the source
string is equal to or greater than /len/.
client/mysqldump.c:
Make room for the trailing null byte.
libmysql/libmysql.c:
Add comment, there is enough room in the buffer.
Increase buffer length, two strings are concatenated.
libmysqld/lib_sql.cc:
Make room for the trailing null byte.
mysys/default.c:
Make room for the trailing null bytes.
mysys/mf_pack.c:
Make room for the trailing null byte.
server-tools/instance-manager/commands.cc:
Copy only if overflow isn't possible in both cases.
server-tools/instance-manager/listener.cc:
Make room for the trailing null byte.
sql/log.cc:
Make room for the trailing null byte.
sql/sp_pcontext.h:
Cosmetic fix.
sql/sql_acl.cc:
MAX_HOSTNAME already specifies space for the trailing null byte.
sql/sql_parse.cc:
Make room for the trailing null byte.
sql/sql_table.cc:
Make room for the trailing null byte.
Diffstat (limited to 'server-tools')
| -rw-r--r-- | server-tools/instance-manager/commands.cc | 2 | ||||
| -rw-r--r-- | server-tools/instance-manager/listener.cc | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/server-tools/instance-manager/commands.cc b/server-tools/instance-manager/commands.cc index bb3763ce8c5..5e8ba5087af 100644 --- a/server-tools/instance-manager/commands.cc +++ b/server-tools/instance-manager/commands.cc @@ -651,7 +651,7 @@ Set_option::Set_option(Instance_map *instance_map_arg, instance_name= instance->options.instance_name; /* add prefix for add_option */ - if ((option_len_arg < MAX_OPTION_LEN - 1) || + if ((option_len_arg < MAX_OPTION_LEN - 1) && (option_value_len_arg < MAX_OPTION_LEN - 1)) { strmake(option, option_arg, option_len_arg); diff --git a/server-tools/instance-manager/listener.cc b/server-tools/instance-manager/listener.cc index 36f0cbe85e1..653a807e5fc 100644 --- a/server-tools/instance-manager/listener.cc +++ b/server-tools/instance-manager/listener.cc @@ -331,7 +331,7 @@ create_unix_socket(struct sockaddr_un &unix_socket_address) unix_socket_address.sun_family= AF_UNIX; strmake(unix_socket_address.sun_path, options.socket_file_name, - sizeof(unix_socket_address.sun_path)); + sizeof(unix_socket_address.sun_path) - 1); unlink(unix_socket_address.sun_path); // in case we have stale socket file /* |