From 501de3a027f11e33c14136f83e45dabe3d6f3102 Mon Sep 17 00:00:00 2001 From: Nisha Gopalakrishnan Date: Thu, 24 Apr 2014 09:30:21 +0530 Subject: BUG#18080920: CRASH; MY_REALLOC_STR DEREFERENCES NEGATIVE VALUE INTO CLIENT_ERRORS ARRAY Analysis: -------- The client may crash while executing a statement due to the missing mapping of the server error to it's equivalent client error. When trying to reallocate memory for the packet buffer, if the system is out of memory or the packet buffer is large, the server errors 'ER_OUT_OF_RESOURCES' or 'ER_PACKET_TOO_LARGE' is returned respectively. The client error number calculated is negative and when trying to dereference the array of client error messages with the calculated error number, the client crashes. Fix: ---- Map the server error returned to it's equivalent client error prior to dereferencing the array of client error messages. Note: Test case is not added since it is difficult to simulate the error condition. --- libmysql/libmysql.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'libmysql/libmysql.c') diff --git a/libmysql/libmysql.c b/libmysql/libmysql.c index d6bdea3df1f..6e7134ff97c 100644 --- a/libmysql/libmysql.c +++ b/libmysql/libmysql.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. +/* Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -1316,6 +1316,10 @@ static my_bool my_realloc_str(NET *net, ulong length) res= net_realloc(net, buf_length + length); if (res) { + if (net->last_errno == ER_OUT_OF_RESOURCES) + net->last_errno= CR_OUT_OF_MEMORY; + else if (net->last_errno == ER_NET_PACKET_TOO_LARGE) + net->last_errno= CR_NET_PACKET_TOO_LARGE; strmov(net->sqlstate, unknown_sqlstate); strmov(net->last_error, ER(net->last_errno)); } -- cgit v1.2.1