From 06a1df91813ea2c39f7312bcf8af972c7e8a926f Mon Sep 17 00:00:00 2001 From: Davi Arnaut Date: Thu, 17 Dec 2009 15:58:38 -0200 Subject: Bug#48983: Bad strmake calls (length one too long) The problem is a somewhat common misusage of the strmake function. The strmake(dst, src, len) function writes at most /len/ bytes to the string pointed to by src, not including the trailing null byte. Hence, if /len/ is the exact length of the destination buffer, a one byte buffer overflow can occur if the length of the source string is equal to or greater than /len/. client/mysqldump.c: Make room for the trailing null byte. libmysql/libmysql.c: Add comment, there is enough room in the buffer. Increase buffer length, two strings are concatenated. libmysqld/lib_sql.cc: Make room for the trailing null byte. mysys/default.c: Make room for the trailing null bytes. mysys/mf_pack.c: Make room for the trailing null byte. server-tools/instance-manager/commands.cc: Copy only if overflow isn't possible in both cases. server-tools/instance-manager/listener.cc: Make room for the trailing null byte. sql/log.cc: Make room for the trailing null byte. sql/sp_pcontext.h: Cosmetic fix. sql/sql_acl.cc: MAX_HOSTNAME already specifies space for the trailing null byte. sql/sql_parse.cc: Make room for the trailing null byte. sql/sql_table.cc: Make room for the trailing null byte. --- server-tools/instance-manager/commands.cc | 2 +- server-tools/instance-manager/listener.cc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'server-tools/instance-manager') diff --git a/server-tools/instance-manager/commands.cc b/server-tools/instance-manager/commands.cc index bb3763ce8c5..5e8ba5087af 100644 --- a/server-tools/instance-manager/commands.cc +++ b/server-tools/instance-manager/commands.cc @@ -651,7 +651,7 @@ Set_option::Set_option(Instance_map *instance_map_arg, instance_name= instance->options.instance_name; /* add prefix for add_option */ - if ((option_len_arg < MAX_OPTION_LEN - 1) || + if ((option_len_arg < MAX_OPTION_LEN - 1) && (option_value_len_arg < MAX_OPTION_LEN - 1)) { strmake(option, option_arg, option_len_arg); diff --git a/server-tools/instance-manager/listener.cc b/server-tools/instance-manager/listener.cc index 36f0cbe85e1..653a807e5fc 100644 --- a/server-tools/instance-manager/listener.cc +++ b/server-tools/instance-manager/listener.cc @@ -331,7 +331,7 @@ create_unix_socket(struct sockaddr_un &unix_socket_address) unix_socket_address.sun_family= AF_UNIX; strmake(unix_socket_address.sun_path, options.socket_file_name, - sizeof(unix_socket_address.sun_path)); + sizeof(unix_socket_address.sun_path) - 1); unlink(unix_socket_address.sun_path); // in case we have stale socket file /* -- cgit v1.2.1