1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug#27980823: HEAP OVERFLOW VULNERABILITIES IN MYSQL CLIENT LIBRARY

Browse Source 
(cherry picked from commit b5b986b2cbd9a7848dc3f48e5c42b6d4e1e5fb22)
This commit is contained in:
Ivo Roylev 2018-06-14 17:27:54 +03:00 committed by Hery Ramilison
parent bd5ca6acec
commit e48d775c6f
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sql-common/client.c
View File

@ -1505,7 +1505,8 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields,
{
uchar *pos;
/* fields count may be wrong */
DBUG_ASSERT((uint) (field - result) < fields);
if (field < result || (uint) (field - result) >= fields)
DBUG_RETURN(NULL);
cli_fetch_lengths(&lengths[0], row->data, default_value ? 8 : 7);
field->catalog= strmake_root(alloc,(char*) row->data[0], lengths[0]);
field->db= strmake_root(alloc,(char*) row->data[1], lengths[1]);
@ -1612,6 +1613,7 @@ MYSQL_DATA *cli_read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields,
if ((pkt_len= cli_safe_read(mysql)) == packet_error)
DBUG_RETURN(0);
if (pkt_len == 0) DBUG_RETURN(0);
if (!(result=(MYSQL_DATA*) my_malloc(sizeof(MYSQL_DATA),
MYF(MY_WME | MY_ZEROFILL))))
{