diff options
| author | Sergei Golubchik <serg@mariadb.org> | 2018-04-30 23:06:09 +0200 |
|---|---|---|
| committer | Sergei Golubchik <serg@mariadb.org> | 2018-05-01 00:30:17 +0200 |
| commit | fab383aac0a713b48765d0464428199470ae8c0a (patch) | |
| tree | a7eb29a44716bd0a333d48a60502660addc23c20 /sql-common | |
| parent | a52c46e06935b09ff9219ae7684b5a29394e992b (diff) | |
| download | mariadb-git-fab383aac0a713b48765d0464428199470ae8c0a.tar.gz | |
Use after free in authentication
Diffstat (limited to 'sql-common')
| -rw-r--r-- | sql-common/client.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sql-common/client.c b/sql-common/client.c index b485ebf4f60..00e2877bedb 100644 --- a/sql-common/client.c +++ b/sql-common/client.c @@ -2742,7 +2742,7 @@ static int client_mpvio_read_packet(struct st_plugin_vio *mpv, uchar **buf) *buf= mysql->net.read_pos; /* was it a request to change plugins ? */ - if (**buf == 254) + if (pkt_len == packet_error || **buf == 254) return (int)packet_error; /* if yes, this plugin shan't continue */ /* @@ -2927,7 +2927,7 @@ int run_plugin_auth(MYSQL *mysql, char *data, uint data_len, compile_time_assert(CR_OK == -1); compile_time_assert(CR_ERROR == 0); - if (res > CR_OK && mysql->net.read_pos[0] != 254) + if (res > CR_OK && (mysql->net.last_errno || mysql->net.read_pos[0] != 254)) { /* the plugin returned an error. write it down in mysql, |