summaryrefslogtreecommitdiff
path: root/sql/sql_partition.cc
diff options
context:
space:
mode:
author <Li-Bing.Song@sun.com>2010-07-29 11:00:57 +0800
committer <Li-Bing.Song@sun.com>2010-07-29 11:00:57 +0800
commit2ad690fdf8a1141be8439a7e2d53974a0d3ec923 (patch)
tree49835843b47b50726e5c3eb2fde225851827a677 /sql/sql_partition.cc
parentf860873c0d1a16b85388f7d02c5bd2d201087513 (diff)
downloadmariadb-git-2ad690fdf8a1141be8439a7e2d53974a0d3ec923.tar.gz
BUG#49124 Security issue with /*!-versioned */ SQL statements on Slave
/*![:version:] Query Code */, where [:version:] is a sequence of 5 digits representing the mysql server version(e.g /*!50200 ... */), is a special comment that the query in it can be executed on those servers whose versions are larger than the version appearing in the comment. It leads to a security issue when slave's version is larger than master's. A malicious user can improve his privileges on slaves. Because slave SQL thread is running with SUPER privileges, so it can execute queries that he/she does not have privileges on master. This bug is fixed with the logic below: - To replace '!' with ' ' in the magic comments which are not applied on master. So they become common comments and will not be applied on slave. - Example: 'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/ will be binlogged as 'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/
Diffstat (limited to 'sql/sql_partition.cc')
-rw-r--r--sql/sql_partition.cc2
1 files changed, 1 insertions, 1 deletions
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc
index 122ae661046..76caa2b0c8d 100644
--- a/sql/sql_partition.cc
+++ b/sql/sql_partition.cc
@@ -3876,7 +3876,7 @@ void get_partition_set(const TABLE *table, uchar *buf, const uint index,
*/
bool mysql_unpack_partition(THD *thd,
- const char *part_buf, uint part_info_len,
+ char *part_buf, uint part_info_len,
const char *part_state, uint part_state_len,
TABLE* table, bool is_create_table_ind,
handlerton *default_db_type,