VladPolskiy/MariaDB-open-code
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 11:45:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bug#21973610: BUFFER OVERFLOW ISSUES

Browse Source 
Description : Incorrect usage of sprintf/strcpy caused
              possible buffer overflow issues at various
              places.

Solution : - Fixed mysql_plugin and mysqlshow
           - Fixed regex library issues

Reviewed-By : Georgi Kodinov <georgi.kodinov@oracle.com>
Reviewed-By : Venkata S Murthy Sidagam <venkata.sidagam@oracle.com>
This commit is contained in:
Harin Vadodaria
2015-11-06 16:41:55 +05:30
parent fd9831410d
commit 0dbd5a8797
4 changed files with 42 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
client/mysql_plugin.c
View File

@ -1,5 +1,5 @@
/*
Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved.
Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -406,7 +406,7 @@ exit:
static void usage(void)
{
PRINT_VERSION;
puts("Copyright (c) 2011, Oracle and/or its affiliates. "
puts("Copyright (c) 2011, 2015, Oracle and/or its affiliates. "
"All rights reserved.\n");
puts("Enable or disable plugins.");
printf("\nUsage: %s [options] <plugin> ENABLE|DISABLE\n\nOptions:\n",
@ -757,6 +757,11 @@ static int check_options(int argc, char **argv, char *operation)
/* read the plugin config file and check for match against argument */
else
{
if (strlen(argv[i]) + 4 + 1 > FN_REFLEN)
{
fprintf(stderr, "ERROR: argument is too long.\n");
return 1;
}
strcpy(plugin_name, argv[i]);
strcpy(config_file, argv[i]);
strcat(config_file, ".ini");
@ -848,6 +853,7 @@ static int process_options(int argc, char *argv[], char *operation)
if (opt_basedir[i-1] != FN_LIBCHAR || opt_basedir[i-1] != FN_LIBCHAR2)
{
char buff[FN_REFLEN];
memset(buff, 0, sizeof(buff));
strncpy(buff, opt_basedir, sizeof(buff) - 1);
#ifdef __WIN__