diff options
| author | Sergei Golubchik <serg@mariadb.org> | 2016-03-17 12:02:28 +0100 |
|---|---|---|
| committer | Sergei Golubchik <serg@mariadb.org> | 2016-03-21 11:43:19 +0100 |
| commit | 8b9432ffacd6843c4b61192866f2d81aa1cad346 (patch) | |
| tree | 81ef8b2f2209505902a302ad54bdf17214a15d08 /sql | |
| parent | ee687771eedd2dd63d6fa094360f88a2b83f2db9 (diff) | |
| download | mariadb-git-8b9432ffacd6843c4b61192866f2d81aa1cad346.tar.gz | |
MDEV-9698 Buffer overflow in extension_based_table_discovery()
fix a buffer overflow in extension_based_table_discovery
(that only happens in debug builds)
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/discover.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sql/discover.cc b/sql/discover.cc index 82648e94bc5..36e3ef72c44 100644 --- a/sql/discover.cc +++ b/sql/discover.cc @@ -206,7 +206,8 @@ int extension_based_table_discovery(MY_DIR *dirp, const char *ext_meta, { size_t len= (octothorp ? octothorp : ext) - cur->name; if (from != cur && - (my_strnncoll(cs, (uchar*)from->name, len, (uchar*)cur->name, len) || + (strlen(from->name) <= len || + my_strnncoll(cs, (uchar*)from->name, len, (uchar*)cur->name, len) || (from->name[len] != FN_EXTCHAR && from->name[len] != '#'))) advance(from, to, cur, skip); |