diff options
| author | Olivier Bertrand <bertrandop@gmail.com> | 2019-03-23 17:51:40 +0100 |
|---|---|---|
| committer | Olivier Bertrand <bertrandop@gmail.com> | 2019-03-23 17:51:40 +0100 |
| commit | fc1f3908c12eea139747a61e659112ac8290bbe7 (patch) | |
| tree | 1349a387dc9d596dec1c3e8ab5f4dc8bd142b60e /storage/connect/tabfmt.cpp | |
| parent | d421df7ea67182750562f22bd514e152f4906da3 (diff) | |
| download | mariadb-git-fc1f3908c12eea139747a61e659112ac8290bbe7.tar.gz | |
- Fix MDEV-15793: Server crash in PlugCloseFile with sql_mode=''
Fixed by replacing sprinf by snprintf in ShowValue to avoid
buffer overflow. It nows always use a buffer and returns int.
modified: storage/connect/tabdos.cpp
modified: storage/connect/tabfmt.cpp
modified: storage/connect/value.cpp
modified: storage/connect/value.h
Diffstat (limited to 'storage/connect/tabfmt.cpp')
| -rw-r--r-- | storage/connect/tabfmt.cpp | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/storage/connect/tabfmt.cpp b/storage/connect/tabfmt.cpp index 63fa2a63668..02720a3089a 100644 --- a/storage/connect/tabfmt.cpp +++ b/storage/connect/tabfmt.cpp @@ -1485,8 +1485,8 @@ void CSVCOL::ReadColumn(PGLOBAL g) /***********************************************************************/ void CSVCOL::WriteColumn(PGLOBAL g) { - char *p, buf[64]; - int flen; + char *p; + int n, flen; PTDBCSV tdbp = (PTDBCSV)To_Tdb; if (trace(2)) @@ -1508,13 +1508,14 @@ void CSVCOL::WriteColumn(PGLOBAL g) /*********************************************************************/ /* Get the string representation of the column value. */ /*********************************************************************/ - p = Value->ShowValue(buf); + p = Value->GetCharString(Buf); + n = strlen(p); if (trace(2)) - htrc("new length(%p)=%d\n", p, strlen(p)); + htrc("new length(%p)=%d\n", p, n); - if ((signed)strlen(p) > flen) { - sprintf(g->Message, MSG(BAD_FLD_LENGTH), Name, p, flen, + if (n > flen) { + sprintf(g->Message, MSG(BAD_FLD_LENGTH), Name, p, n, tdbp->RowNumber(g), tdbp->GetFile(g)); throw 34; } else if (Dsp) |