1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

BUG#18080920: CRASH; MY_REALLOC_STR DEREFERENCES NEGATIVE VALUE

Browse Source 
INTO CLIENT_ERRORS ARRAY
              
Analysis:
--------
The client may crash while executing a statement due to
the missing mapping of the server error to it's equivalent
client error.

When trying to reallocate memory for the packet buffer, if
the system is out of memory or the packet buffer is large,
the server errors 'ER_OUT_OF_RESOURCES' or 'ER_PACKET_TOO_LARGE'
is returned respectively. The client error number calculated is
negative and when trying to dereference the array of client 
error messages with the calculated error number, the client
crashes.

Fix:
----
Map the server error returned to it's equivalent client error
prior to dereferencing the array of client error messages.

Note: Test case is not added since it is difficult to simulate
the error condition.
This commit is contained in:
Nisha Gopalakrishnan 2014-04-24 09:30:21 +05:30
parent c006e3f27a
commit 56cf9d2db4
3 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/errmsg.h
View File

@ -1,7 +1,7 @@
#ifndef ERRMSG_INCLUDED
#define ERRMSG_INCLUDED
/* Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -32,7 +32,9 @@ extern const char *client_errors[]; /* Error messages */
#define CR_MIN_ERROR 2000 /* For easier client code */
#define CR_MAX_ERROR 2999
#if !defined(ER)
#define ER(X) client_errors[(X)-CR_MIN_ERROR]
#define ER(X) (((X) >= CR_ERROR_FIRST && (X) <= CR_ERROR_LAST)? \
client_errors[(X)-CR_ERROR_FIRST]: client_errors[CR_UNKNOWN_ERROR])
#endif
#define CLIENT_ERRMAP 2 /* Errormap used by my_error() */

4
libmysql/errmsg.c
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -105,6 +105,8 @@ const char** get_client_errmsgs()
void init_client_errs(void)
{
compile_time_assert(array_elements(client_errors) ==
(CR_ERROR_LAST - CR_ERROR_FIRST + 2));
(void) my_error_register(get_client_errmsgs, CR_ERROR_FIRST, CR_ERROR_LAST);
}

6
libmysql/libmysql.c
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
/* Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -1316,6 +1316,10 @@ static my_bool my_realloc_str(NET *net, ulong length)
res= net_realloc(net, buf_length + length);
if (res)
{
if (net->last_errno == ER_OUT_OF_RESOURCES)
net->last_errno= CR_OUT_OF_MEMORY;
else if (net->last_errno == ER_NET_PACKET_TOO_LARGE)
net->last_errno= CR_NET_PACKET_TOO_LARGE;
strmov(net->sqlstate, unknown_sqlstate);
strmov(net->last_error, ER(net->last_errno));
}