Bug #51893 crash with certain characters given to load_file function on windows

• Submitted: 9 Mar 2010 21:31
• Modified: 18 Jun 2010 1:23
• Reporter: Shane Bester (Platinum Quality Contributor)
• Status: Closed
• Category: MySQL Server: DML
• Severity: S1 (Critical)
• Version: 5.0.90, 5.1.44, 5.5.2-m2
• OS: Windows (XP)
• Assigned to: Georgi Kodinov
• CPU Architecture: Any
• Tags: load_file

[9 Mar 2010 21:31] Shane Bester

Description:
5.1.44 release binary detects corruption here and crashes:

mysqld.exe!__crt_debugger_hook
mysqld.exe!__report_gsfailure
mysqld.exe!normalize_dirname
mysqld.exe!unpack_dirname
mysqld.exe!fn_format
mysqld.exe!Item_load_file::val_str
mysqld.exe!Item::send
mysqld.exe!select_send::send_data
mysqld.exe!JOIN::exec
mysqld.exe!mysql_select
mysqld.exe!handle_select
mysqld.exe!execute_sqlcom_select
mysqld.exe!mysql_execute_command
mysqld.exe!mysql_parse
mysqld.exe!dispatch_command
mysqld.exe!do_command
mysqld.exe!handle_one_connection
mysqld.exe!pthread_start
mysqld.exe!_callthreadstart
mysqld.exe!_threadstart

Windows debug binaries print safemalloc errors in the logs:
Error:Run-Time Check Failure #2 - Stack around the variable 'buff' was corrupted. At g:\mysql-5.1.44-winbuild\mysql-advanced-gpl-debug-5.1.44-build\mysys\mf_pack.c:321

How to repeat:
\o/

[9 Mar 2010 21:32] MySQL Verification Team

windows testcase.

Attachment: bug51893_testcase.sql (application/octet-stream, text), 1.60 KiB.

[9 Mar 2010 21:53] MySQL Verification Team

C:\DBS>cat 5.1\data\tikal.err
100309 18:34:28 [Note] Plugin 'FEDERATED' is disabled.
100309 18:34:28 [Note] Event Scheduler: Loaded 0 events
100309 18:34:28 [Note] C:\DBS\5.1\bin\mysqld: ready for connections.
Version: '5.1.46-Win X64-debug-log'  socket: ''  port: 3306  Source distribution
Error:Run-Time Check Failure #2 - Stack around the variable 'buff' was corrupted. At :0

[9 Mar 2010 22:16] MySQL Verification Team

Repeatable on 5.1.32:

100309 19:14:05 [Note] bin\mysqld-debug: ready for connections.
Version: '5.1.32-community-debug'  socket: ''  port: 3306  MySQL Community Server - Debug (GPL)
Error:Run-Time Check Failure #2 - Stack around the variable 'buff' was corrupted. At :0

[23 Mar 2010 14:54] Bugs System

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/104096

3412 Georgi Kodinov	2010-03-23
      Bug #51893: crash with certain characters given to load_file 
        function on windows
      
      When making sure that the directory path ends up with a 
      slash/backslash we need to check for the correct length of 
      the buffer and trim at the appropriate location so we don't
      write past the end of the buffer.

[6 Apr 2010 7:54] Bugs System

Pushed into 5.0.91 (revid:[e-mail]-20100406075152-flz4btqirl9hly31) (version source revid:[e-mail]-20100330120350-nts3p251bgmquodi) (merge vers: 5.0.91) (pib:16)

[6 Apr 2010 7:57] Bugs System

Pushed into 5.1.46 (revid:[e-mail]-20100405111026-7kz1p8qlzglqgfmu) (version source revid:[e-mail]-20100330121025-r7wz0k8dlf3b0q0e) (merge vers: 5.1.46) (pib:16)

[15 Apr 2010 16:07] Paul DuBois

Noted in 5.0.91, 5.1.46 changelogs.

On Windows, LOAD_FILE() could cause a crash for some path names.

Setting report to Need Merge pending push into Celosia.

[28 May 2010 5:52] Bugs System

Pushed into mysql-next-mr (revid:[e-mail]-20100524190136-egaq7e8zgkwb9aqi) (version source revid:[e-mail]-20100422150750-vp0n37kp9ywq5ghf) (pib:16)

[28 May 2010 6:21] Bugs System

Pushed into 6.0.14-alpha (revid:[e-mail]-20100524190941-nuudpx60if25wsvx) (version source revid:[e-mail]-20100422150658-fkhgnwwkyugtxrmu) (merge vers: 6.0.14-alpha) (pib:16)

[28 May 2010 6:49] Bugs System

Pushed into 5.5.5-m3 (revid:[e-mail]-20100524185725-c8k5q7v60i5nix3t) (version source revid:[e-mail]-20100403173551-52r97erqowlqwkon) (merge vers: 5.5.4-m3) (pib:16)

[29 May 2010 2:26] Paul DuBois

Noted in 5.5.5, 6.0.14 changelogs.

[17 Jun 2010 12:11] Bugs System

Pushed into 5.1.47-ndb-7.0.16 (revid:[e-mail]-20100617114014-bva0dy24yyd67697) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)

[17 Jun 2010 12:58] Bugs System

Pushed into 5.1.47-ndb-6.2.19 (revid:[e-mail]-20100617115448-idrbic6gbki37h1c) (version source revid:[e-mail]-20100609211156-tsac5qhw951miwtt) (merge vers: 5.1.46-ndb-6.2.19) (pib:16)

[17 Jun 2010 13:38] Bugs System

Pushed into 5.1.47-ndb-6.3.35 (revid:[e-mail]-20100617114611-61aqbb52j752y116) (version source revid:[e-mail]-20100331130613-8ja7n0vh36a80457) (merge vers: 5.1.46) (pib:16)