| Bug #26303 | buffer overflow? reserve() not called before qs_append() | ||
|---|---|---|---|
| Submitted: | 12 Feb 2007 23:51 | Modified: | 5 Apr 2007 20:02 |
| Reporter: | Chongfeng Hu | Email Updates: | |
| Status: | Closed | Impact on me: | |
| Category: | MySQL Server | Severity: | S2 (Serious) |
| Version: | 5.1.17-BK, 5.2.0-falcon-alpha | OS: | Linux (Linux) |
| Assigned to: | Georgi Kodinov | CPU Architecture: | Any |
[4 Mar 2007 19:24]
Valeriy Kravchuk
Thank you for a problem report. Verified just as described with code review of latest 5.1.17-BK.
[21 Mar 2007 10:10]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/22451 ChangeSet@1.2506, 2007-03-21 12:10:37+02:00, gkodinov@magare.gmz +3 -0 Bug #26303: The String::qs_append() function will append a string without checking if there's enough space. So qs_append() must be called beforehand to ensure there's enough space in the buffer for the subsequent qs_append() calls. Fixed Item_case_expr::print() to make sure there's enough space before appending data: 1. Defined the possible max digits in an INT 2. added a call to String::reserve() to make sure qs_append will have enough space
[23 Mar 2007 14:47]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/22785 ChangeSet@1.2506, 2007-03-23 16:47:11+02:00, gkodinov@magare.gmz +3 -0 Bug #26303: The String::qs_append() function will append a string without checking if there's enough space. So qs_append() must be called beforehand to ensure there's enough space in the buffer for the subsequent qs_append() calls. Fixed Item_case_expr::print() to make sure there's enough space before appending data by adding a call to String::reserve() to make sure qs_append() will have enough space.
[23 Mar 2007 15:38]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/22791 ChangeSet@1.2506, 2007-03-23 17:38:25+02:00, gkodinov@magare.gmz +3 -0 Bug #26303: Reserve is not called before qs_append(). This may lead to buffer overflow. The String::qs_append() function will append a string without checking if there's enough space. So qs_append() must be called beforehand to ensure there's enough space in the buffer for the subsequent qs_append() calls. Fixed Item_case_expr::print() to make sure there's enough space before appending data by adding a call to String::reserve() to make sure qs_append() will have enough space.
[26 Mar 2007 9:33]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/22926 ChangeSet@1.2506, 2007-03-26 12:32:51+03:00, gkodinov@magare.gmz +4 -0 Bug #26303: Reserve is not called before qs_append(). This may lead to buffer overflow. The String::qs_append() function will append a string without checking if there's enough space. So qs_append() must be called beforehand to ensure there's enough space in the buffer for the subsequent qs_append() calls. Fixed Item_case_expr::print() to make sure there's enough space before appending data by adding a call to String::reserve() to make sure qs_append() will have enough space.
[31 Mar 2007 8:39]
Bugs System
Pushed into 5.1.18-beta
[5 Apr 2007 20:02]
Paul DuBois
Noted in 5.1.18 changelog. Fixed a possible buffer overflow in SHOW PROCEDURE CODE.
Description: When I checked the code in sql/item.cc, I found one place (in function definition void Item_case_expr::print(String *str) at line 1131) where qs_append() is called without calling reserve() beforehand, and this might cause buffer overflow problem. What qs_append() does is that it append a string at the end of the string pointed by Ptr, and what reserve() does is that it make sure that there's enough space at the end of the string, if not, it will reallocate a space for the string pointed by Ptr. However, qs_append() do NOT check alloced memory, and calling it without calling reserve() first will cause potential buffer overflow. Following is the segment of code that is involved: 1131 void Item_case_expr::print(String *str) 1132 { 1133 VOID(str->append(STRING_WITH_LEN("case_expr@"))); 1134 str->qs_append(m_case_expr_id); 1135 } How to repeat: No test case yet. It is reported by a source code analysis tool. Suggested fix: add a str->reserve() call at the beginning of the function.