diff options
| -rw-r--r-- | sql/sql_parse.cc | 4 | ||||
| -rw-r--r-- | tests/mysql_client_test.c | 22 |
2 files changed, 24 insertions, 2 deletions
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc index 0b7d0e6ee10..bcde4a971d0 100644 --- a/sql/sql_parse.cc +++ b/sql/sql_parse.cc @@ -2096,7 +2096,7 @@ bool dispatch_command(enum enum_server_command command, THD *thd, } if (check_access(thd,CREATE_ACL,db,0,1,0,is_schema_db(db))) break; - mysql_log.write(thd,command,packet); + mysql_log.write(thd, command, "%s", db); bzero(&create_info, sizeof(create_info)); mysql_create_db(thd, (lower_case_table_names == 2 ? alias : db), &create_info, 0); @@ -2121,7 +2121,7 @@ bool dispatch_command(enum enum_server_command command, THD *thd, ER(ER_LOCK_OR_ACTIVE_TRANSACTION), MYF(0)); break; } - mysql_log.write(thd,command,db); + mysql_log.write(thd, command, "%s", db); mysql_rm_db(thd, db, 0, 0); break; } diff --git a/tests/mysql_client_test.c b/tests/mysql_client_test.c index 9dfacb7436d..ce1a1a99b04 100644 --- a/tests/mysql_client_test.c +++ b/tests/mysql_client_test.c @@ -12063,6 +12063,27 @@ static void test_bug6081() } +/* + Verify that bogus database names are handled properly with + COM_CREATE_DB and COM_DROP_DB, i.e., cannot cause SIGSEGV through + the use of printf specifiers in the database name. +*/ +static void test_bug45790() +{ + const char* bogus_db = "%s%s%s%s%s%s%s"; + int rc; + + myheader("test_bug45790"); + rc= simple_command(mysql, COM_CREATE_DB, bogus_db, + (ulong)strlen(bogus_db), 0); + myquery(rc); + + rc= simple_command(mysql, COM_DROP_DB, bogus_db, + (ulong)strlen(bogus_db), 0); + myquery(rc); +} + + static void test_bug6096() { MYSQL_STMT *stmt; @@ -16829,6 +16850,7 @@ static struct my_tests_st my_tests[]= { { "test_bug6059", test_bug6059 }, { "test_bug6046", test_bug6046 }, { "test_bug6081", test_bug6081 }, + { "test_bug45790",test_bug45790 }, { "test_bug6096", test_bug6096 }, { "test_datetime_ranges", test_datetime_ranges }, { "test_bug4172", test_bug4172 }, |