Bug #38009 Segmentation fault when calling mysql_real_query() on an unconnected client

• Submitted: 10 Jul 2008 7:28
• Modified: 10 Jul 2008 12:18
• Reporter: Mats Kindahl
• Status: Not a Bug
• Category: MySQL Server: C API (client library)
• Severity: S3 (Non-critical)
• Version: 5.0
• OS: Linux (Ubuntu 2.6.24-19.34-generic)
• CPU Architecture: Any

[10 Jul 2008 7:28] Mats Kindahl

Description:
If an attempt is done to call mysql_real_query() using a MYSQL instance that has been initialized but not connected causes a segmentation fault.

How to repeat:
Compiling and executing::

  #include <mysql/mysql.h>
  #include <stdlib.h>

  int main() {
    const char query[] = "SHOW DATABASES";
    MYSQL *mysql;
    int errno;
    mysql = mysql_init(NULL);
    printf("mysql: 0x%lx\n", mysql);
    errno = mysql_real_query(mysql, query, sizeof(query));
    printf("errno: %d\n", errno); 
  }

gives::

  $ ./test-1
  mysql: 0x804ac88
  Segmentation fault

Suggested fix:
Return an error instead of cause a segmentation fault.

The field mysql->methods is not inited by mysql_init(), which causes a crash inside mysql_send_query() when trying to use the mysql->methods->advanced_command field.

[10 Jul 2008 12:18] Sergei Golubchik

It's intentional, we rely on the caller to do these checks (just like libc expects you not to pass a null pointer to strcpy).