diff options
| author | Davi Arnaut <Davi.Arnaut@Sun.COM> | 2009-12-17 15:58:38 -0200 |
|---|---|---|
| committer | Davi Arnaut <Davi.Arnaut@Sun.COM> | 2009-12-17 15:58:38 -0200 |
| commit | b9380f0e76b34af223c4ef0b4fe648ddca47a59c (patch) | |
| tree | dac324abc82ad6d66e71348f8270ff42658c84a9 /sql/log.cc | |
| parent | 0f7397908466421a857fd1718766c41ef7648c9b (diff) | |
| download | mariadb-git-b9380f0e76b34af223c4ef0b4fe648ddca47a59c.tar.gz | |
Bug#48983: Bad strmake calls (length one too long)
The problem is a somewhat common misusage of the strmake function.
The strmake(dst, src, len) function writes at most /len/ bytes to
the string pointed to by src, not including the trailing null byte.
Hence, if /len/ is the exact length of the destination buffer, a
one byte buffer overflow can occur if the length of the source
string is equal to or greater than /len/.
Diffstat (limited to 'sql/log.cc')
| -rw-r--r-- | sql/log.cc | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sql/log.cc b/sql/log.cc index c042651216c..4aeab534b23 100644 --- a/sql/log.cc +++ b/sql/log.cc @@ -501,7 +501,7 @@ const char *MYSQL_LOG::generate_name(const char *log_name, { char *p = fn_ext(log_name); uint length=(uint) (p-log_name); - strmake(buff,log_name,min(length,FN_REFLEN)); + strmake(buff, log_name, min(length, FN_REFLEN-1)); return (const char*)buff; } return log_name; @@ -1503,7 +1503,7 @@ int MYSQL_LOG::purge_logs_before_date(time_t purge_time) if (stat_area.st_mtime < purge_time) strmake(to_log, log_info.log_file_name, - sizeof(log_info.log_file_name)); + sizeof(log_info.log_file_name) - 1); else break; } @@ -2604,11 +2604,11 @@ bool flush_error_log() if (opt_error_log) { char err_renamed[FN_REFLEN], *end; - end= strmake(err_renamed,log_error_file,FN_REFLEN-4); + end= strmake(err_renamed,log_error_file,FN_REFLEN-5); strmov(end, "-old"); VOID(pthread_mutex_lock(&LOCK_error_log)); #ifdef __WIN__ - char err_temp[FN_REFLEN+4]; + char err_temp[FN_REFLEN+5]; /* On Windows is necessary a temporary file for to rename the current error file. |