MySQL Bugs: #33976: buffer overflow of variable time_buff in function com

Bug #33976	buffer overflow of variable time_buff in function com_go()
Submitted:	22 Jan 2008 10:25	Modified:	25 Jan 2008 0:55
Reporter:	Shane Bester (Platinum Quality Contributor)	Email Updates:
Status:	Duplicate	Impact on me:	None
Category:	MySQL Server: Command-line Clients	Severity:	S2 (Serious)
Version:	5.1.23	OS:	Any
Assigned to:		CPU Architecture:	Any
Tags:	buffer overflow

Description:
When a query takes a long time to complete, a buffer overflow occurs in the buffer that prints the time taken:

mysql> select 1;select sleep(4);select 4;
+---+
| 1 |
+---+
| 1 |
+---+
1 row in set (0.00 sec)

+----------+
| sleep(4) |
+----------+
|        0 |
+----------+
1 row in set (4 days 13 hours 54 min 29.41 sec)

Error:Run-Time Check Failure #2 - Stack around the variable 'time_buff' was corrupted. At e:\builds\5.1-win-src-32bit\client\mysql.cc:2328
+---+
| 4 |
+---+
| 4 |
+---+
1 row in set (0.00 sec)

Notice the length of "(4 days 13 hours 54 min 29.41 sec)" is more than time_buff[32] can hold.

How to repeat:
Run a debug version of mysql client, or run it under valgrind. Just make sure you get a time taken with "(X days YY hours ZZ mins SS.MM sec)":

select 1;select sleep(45);select 4;

During that sleep(45), advance the system datetime forward by some days so mysql thinks it took really long.

Code review should be easier..

Suggested fix:
increase the length of the time_buff buffer in com_go(). Make it at least 4 characters larger..

maybe related to bug #33841

This is a duplicate of Bug #33841.

Pushed into 5.1.24-rc

Pushed into 6.0.5-alpha

Pushed into 5.0.58

Pushed into 4.1.24