Bug #34788 malformed federated connection url is not handled correctly - crashes server !

Submitted: 24 Feb 2008 13:23 Modified: 2 Apr 2008 20:36
Reporter: Shane Bester (Platinum Quality Contributor) Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Federated storage engine Severity:S1 (Critical)
Version:5.0.56, 5.1.23 OS:Any
Assigned to: Sergey Vojtovich CPU Architecture:Any
Tags: GIGO

[24 Feb 2008 13:23] Shane Bester
Description:
mysqld-release.exe!parse_url
mysqld-release.exe!ha_federated::create
mysqld-release.exe!ha_create_table
mysqld-release.exe!rea_create_table
mysqld-release.exe!mysql_create_table_no_lock
mysqld-release.exe!mysql_create_table
mysqld-release.exe!mysql_execute_command
mysqld-release.exe!mysql_parse
mysqld-release.exe!dispatch_command
mysqld-release.exe!do_command
mysqld-release.exe!handle_one_connection
mysqld-release.exe!pthread_start
mysqld-release.exe!_callthreadstart
mysqld-release.exe!_threadstart
kernel32.dll!BaseThreadStart

How to repeat:
drop temporary table if exists `t0`;
create temporary table `t0`(`a` int)engine=federated connection='mysql://@:://';

Suggested fix:
parse_url should be more robust and be able to graciously hand anything.
[24 Feb 2008 13:34] Valeriy Kravchuk
Thank you for a bug report. Verified just as described.
[20 Mar 2008 12:54] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/44281

ChangeSet@1.2599, 2008-03-20 16:50:05+04:00, svoj@mysql.com +3 -0
  BUG#34788 - malformed federated connection url is not handled
              correctly - crashes server !
  
  Createing federated table with connect string containing empty
  (zero-length) host name and port is evaluated as 0 (port is
  incorrect, omitted or 0) crashes server.
  
  This happens because federated calls strcmp() with NULL pointer.
  
  Fixed by avoiding strcmp() call if hostname is set to NULL.
[20 Mar 2008 14:21] Alexander Barkov
http://lists.mysql.com/commits/44281 is ok to push
[20 Mar 2008 14:46] Ingo Strüwing
Ok to push. But "Createing" is correctly spelled "Creating" IMHO.
[20 Mar 2008 15:12] Bugs System
A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/44292

ChangeSet@1.2599, 2008-03-20 19:07:17+04:00, svoj@mysql.com +3 -0
  BUG#34788 - malformed federated connection url is not handled
              correctly - crashes server !
  
  Creating federated table with connect string containing empty
  (zero-length) host name and port is evaluated as 0 (port is
  incorrect, omitted or 0) crashes server.
  
  This happens because federated calls strcmp() with NULL pointer.
  
  Fixed by avoiding strcmp() call if hostname is set to NULL.
[27 Mar 2008 11:18] Bugs System
Pushed into 5.1.24-rc
[27 Mar 2008 11:21] Bugs System
Pushed into 5.0.60
[27 Mar 2008 17:50] Bugs System
Pushed into 6.0.5-alpha
[2 Apr 2008 20:36] Jon Stephens
Documented in the 5.0.60, 5.1.23-ndb-6.3.11, 5.1.24, and 6.0.5 changelogs as follows:

        A malformed URL used for a FEDERATED table's CONNECTION option value in a 
        CREATE TABLE statement was not handled correctly and could crash the 
        server.

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.064 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.