diff options
| author | Vladislav Vaintroub <wlad@mariadb.com> | 2019-05-25 22:59:33 +0200 |
|---|---|---|
| committer | Vladislav Vaintroub <wlad@mariadb.com> | 2019-05-25 22:59:33 +0200 |
| commit | 88b7926ff845f4bd3d5794008ae75f35f442cfbd (patch) | |
| tree | 05a82813933f841fc85f1b01ab44079e8be5a9c7 /sql/log_event.cc | |
| parent | 5d2619b6931a967df52acb6cb650c0619dcc70d2 (diff) | |
| download | mariadb-git-88b7926ff845f4bd3d5794008ae75f35f442cfbd.tar.gz | |
MDEV-19582 WolfSSL decyption function can read memory out-of-bounds.
MDEV-19581 Valgrind error with WolfSSL and encrypted binlog
WolfSSL can read memory out of bounds in EVP_CipherUpdate()
in decrypt/NOPAD mode, when the input length is not multiple of AES block
size.
The workaround ensures that input will have some padding at the end
by having slightly larger allocated buffer, or padding the structures
with 16 more bytes.
Diffstat (limited to 'sql/log_event.cc')
| -rw-r--r-- | sql/log_event.cc | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/sql/log_event.cc b/sql/log_event.cc index 95d602a0d8e..d303f345949 100644 --- a/sql/log_event.cc +++ b/sql/log_event.cc @@ -1847,8 +1847,16 @@ int Log_event::read_log_event(IO_CACHE* file, String* packet, { uchar iv[BINLOG_IV_LENGTH]; fdle->crypto_data.set_iv(iv, (uint32) (my_b_tell(file) - data_len)); - - char *newpkt= (char*)my_malloc(data_len + ev_offset + 1, MYF(MY_WME)); + size_t sz= data_len + ev_offset + 1; +#ifdef HAVE_WOLFSSL + /* + Workaround for MDEV-19582. + WolfSSL reads memory out of bounds with decryption/NOPAD) + We allocate a little more memory therefore. + */ + sz += MY_AES_BLOCK_SIZE; +#endif + char *newpkt= (char*)my_malloc(sz, MYF(MY_WME)); if (!newpkt) DBUG_RETURN(LOG_READ_MEM); memcpy(newpkt, packet->ptr(), ev_offset); |