From 0dbd5a8797ed4bd18e8b883988fb62177eb0f73f Mon Sep 17 00:00:00 2001 From: Harin Vadodaria Date: Fri, 6 Nov 2015 16:41:55 +0530 Subject: Bug#21973610: BUFFER OVERFLOW ISSUES Description : Incorrect usage of sprintf/strcpy caused possible buffer overflow issues at various places. Solution : - Fixed mysql_plugin and mysqlshow - Fixed regex library issues Reviewed-By : Georgi Kodinov Reviewed-By : Venkata S Murthy Sidagam --- client/mysqlshow.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) (limited to 'client/mysqlshow.c') diff --git a/client/mysqlshow.c b/client/mysqlshow.c index a6705548bcb..6cbbc5e2463 100644 --- a/client/mysqlshow.c +++ b/client/mysqlshow.c @@ -377,7 +377,7 @@ list_dbs(MYSQL *mysql,const char *wild) uint length, counter = 0; ulong rowcount = 0L; char tables[NAME_LEN+1], rows[NAME_LEN+1]; - char query[255]; + char query[NAME_LEN + 100]; MYSQL_FIELD *field; MYSQL_RES *result; MYSQL_ROW row= NULL, rrow; @@ -444,7 +444,8 @@ list_dbs(MYSQL *mysql,const char *wild) MYSQL_ROW trow; while ((trow = mysql_fetch_row(tresult))) { - sprintf(query,"SELECT COUNT(*) FROM `%s`",trow[0]); + my_snprintf(query, sizeof(query), + "SELECT COUNT(*) FROM `%s`", trow[0]); if (!(mysql_query(mysql,query))) { MYSQL_RES *rresult; @@ -500,7 +501,7 @@ list_tables(MYSQL *mysql,const char *db,const char *table) { const char *header; uint head_length, counter = 0; - char query[255], rows[NAME_LEN], fields[16]; + char query[NAME_LEN + 100], rows[NAME_LEN], fields[16]; MYSQL_FIELD *field; MYSQL_RES *result; MYSQL_ROW row, rrow; @@ -585,7 +586,8 @@ list_tables(MYSQL *mysql,const char *db,const char *table) if (opt_verbose > 1) { /* Print the count of rows for each table */ - sprintf(query,"SELECT COUNT(*) FROM `%s`",row[0]); + my_snprintf(query, sizeof(query), "SELECT COUNT(*) FROM `%s`", + row[0]); if (!(mysql_query(mysql,query))) { if ((rresult = mysql_store_result(mysql))) @@ -645,13 +647,15 @@ list_tables(MYSQL *mysql,const char *db,const char *table) static int list_table_status(MYSQL *mysql,const char *db,const char *wild) { - char query[1024],*end; + char query[NAME_LEN + 100]; + int len; MYSQL_RES *result; MYSQL_ROW row; - end=strxmov(query,"show table status from `",db,"`",NullS); - if (wild && wild[0]) - strxmov(end," like '",wild,"'",NullS); + len= sizeof(query); + len-= my_snprintf(query, len, "show table status from `%s`", db); + if (wild && wild[0] && len) + strxnmov(query + strlen(query), len, " like '", wild, "'", NullS); if (mysql_query(mysql,query) || !(result=mysql_store_result(mysql))) { fprintf(stderr,"%s: Cannot get status for db: %s, table: %s: %s\n", @@ -683,7 +687,8 @@ static int list_fields(MYSQL *mysql,const char *db,const char *table, const char *wild) { - char query[1024],*end; + char query[NAME_LEN + 100]; + int len; MYSQL_RES *result; MYSQL_ROW row; ulong UNINIT_VAR(rows); @@ -697,7 +702,7 @@ list_fields(MYSQL *mysql,const char *db,const char *table, if (opt_count) { - sprintf(query,"select count(*) from `%s`", table); + my_snprintf(query, sizeof(query), "select count(*) from `%s`", table); if (mysql_query(mysql,query) || !(result=mysql_store_result(mysql))) { fprintf(stderr,"%s: Cannot get record count for db: %s, table: %s: %s\n", @@ -709,9 +714,11 @@ list_fields(MYSQL *mysql,const char *db,const char *table, mysql_free_result(result); } - end=strmov(strmov(strmov(query,"show /*!32332 FULL */ columns from `"),table),"`"); - if (wild && wild[0]) - strxmov(end," like '",wild,"'",NullS); + len= sizeof(query); + len-= my_snprintf(query, len, "show /*!32332 FULL */ columns from `%s`", + table); + if (wild && wild[0] && len) + strxnmov(query + strlen(query), len, " like '", wild, "'", NullS); if (mysql_query(mysql,query) || !(result=mysql_store_result(mysql))) { fprintf(stderr,"%s: Cannot list columns in db: %s, table: %s: %s\n", @@ -732,7 +739,7 @@ list_fields(MYSQL *mysql,const char *db,const char *table, print_res_top(result); if (opt_show_keys) { - end=strmov(strmov(strmov(query,"show keys from `"),table),"`"); + my_snprintf(query, sizeof(query), "show keys from `%s`", table); if (mysql_query(mysql,query) || !(result=mysql_store_result(mysql))) { fprintf(stderr,"%s: Cannot list keys in db: %s, table: %s: %s\n", -- cgit v1.2.1