diff options
| author | unknown <anozdrin/alik@alik.> | 2006-08-23 21:31:00 +0400 |
|---|---|---|
| committer | unknown <anozdrin/alik@alik.> | 2006-08-23 21:31:00 +0400 |
| commit | f96ee72fb07961faf1ee950fcb66c2dfa0589694 (patch) | |
| tree | 33f16ff37ffb4d6166ab1d1376dc7f488cde6df7 /sql/share | |
| parent | 09e9b2f6cd92d7a75dfb6e46fadd9be2c326c8f5 (diff) | |
| download | mariadb-git-f96ee72fb07961faf1ee950fcb66c2dfa0589694.tar.gz | |
Fix for BUG#16899: Possible buffer overflow in handling of DEFINER-clause
User name (host name) has limit on length. The server code relies on these
limits when storing the names. The problem was that sometimes these limits
were not checked properly, so that could lead to buffer overflow.
The fix is to check length of user/host name in parser and if string is too
long, throw an error.
mysql-test/r/grant.result:
Updated result file.
mysql-test/r/sp.result:
Updated result file.
mysql-test/r/trigger.result:
Updated result file.
mysql-test/r/view.result:
Updated result file.
mysql-test/t/grant.test:
Added test for BUG#16899.
mysql-test/t/sp.test:
Added test for BUG#16899.
mysql-test/t/trigger.test:
Added test for BUG#16899.
mysql-test/t/view.test:
Added test for BUG#16899.
sql/mysql_priv.h:
Added prototype for new function.
sql/share/errmsg.txt:
Added new resources.
sql/sql_acl.cc:
Remove outdated checks.
sql/sql_parse.cc:
Add a new function for checking string length.
sql/sql_yacc.yy:
Check length of user/host name.
Diffstat (limited to 'sql/share')
| -rw-r--r-- | sql/share/errmsg.txt | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sql/share/errmsg.txt b/sql/share/errmsg.txt index 5c967ba19bd..b3cb33090ce 100644 --- a/sql/share/errmsg.txt +++ b/sql/share/errmsg.txt @@ -5623,3 +5623,9 @@ ER_NO_TRIGGERS_ON_SYSTEM_SCHEMA eng "Triggers can not be created on system tables" ER_REMOVED_SPACES eng "Leading spaces are removed from name '%s'" +ER_USERNAME + eng "user name" +ER_HOSTNAME + eng "host name" +ER_WRONG_STRING_LENGTH + eng "String '%-.70s' is too long for %s (should be no longer than %d)" |