| Bug #47120 | ErrorReporter::formatMessage overruns the buffer | ||
|---|---|---|---|
| Submitted: | 4 Sep 2009 5:37 | Modified: | 3 Mar 2010 5:47 |
| Reporter: | jack andrews | Email Updates: | |
| Status: | Need Merge | Impact on me: | |
| Category: | MySQL Cluster: Cluster (NDB) storage engine | Severity: | S3 (Non-critical) |
| Version: | mysql-5.1-telco-7.0 | OS: | Any |
| Assigned to: | Assigned Account | CPU Architecture: | Any |
[4 Sep 2009 8:17]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/82415 2977 jack andrews 2009-09-04 Bug #47120: ErrorReporter::formatMessage overruns the buffer
[4 Sep 2009 11:08]
Magnus Blåudd
Please write a patch that simply truncates the error message
[7 Sep 2009 4:06]
jack andrews
jonas suggested making buffer bigger and to fix the overrun bug.
[1 Dec 2009 7:07]
jack andrews
i'm trying to write a tap unit test to reproduce the error, but following all the includes and dependencies, i have to include and link everything under src/kernel.
here's what i'm' trying to do in ErrorReporter.cpp
#ifdef TEST
#include <NdbTap.hpp>
TAPTEST(BaseString)
{
/*
formatMessage(int thr_no, Uint32 num_threads, int faultID,
const char* problemData, const char* objRef,
const char* theNameOfTheTraceFile, char* messptr)
*/
ErrorReporter::formatMessage(1,2,3,"problem","objref","trace","messptr");
return 1;
}
#endif
[3 Feb 2010 6:32]
jack andrews
i can't see anything wrong with ErrorReporter::formatMessage() -- at least, i can't see any thing wrong with the snprintf()s. i can't reproduce because the bug that exposed the problem has been fixed.
[25 Feb 2010 4:35]
jack andrews
to reproduce, apply patch below and start a ndbd.
=== modified file 'storage/ndb/src/kernel/vm/Mutex.hpp'
--- storage/ndb/src/kernel/vm/Mutex.hpp 2009-05-27 12:11:46 +0000
+++ storage/ndb/src/kernel/vm/Mutex.hpp 2010-02-25 04:30:58 +0000
@@ -272,6 +272,11 @@
inline
bool
Mutex::create(SimulatedBlock::Callback & callback){
+ char *s=(char*)malloc(9999);
+ for(int i=0;i<9998;i++)s[i]='Z';
+ s[9998]=0;
+ ErrorReporter::handleAssert(s, __FILE__, __LINE__);
+
if(m_ptr.isNull()){
if(m_mgr.seize(m_ptr)){
m_ptr.p->m_mutexId = m_mutexId;
[25 Feb 2010 5:08]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/101400 3412 Jack Andrews 2010-02-25 Bug #47120 ErrorReporter::formatMessage overruns the buffer . fixed buffer overflow
[1 Mar 2010 11:59]
Magnus Blåudd
Patch is ok.
[2 Mar 2010 1:16]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/101988 3413 Jack Andrews 2010-03-02 [merge] merge for Bug #47120 ErrorReporter::formatMessage overruns the buffer
[2 Mar 2010 1:17]
Bugs System
Pushed into 5.1.41-ndb-7.0.14 (revid:jack@sun.com-20100302011538-xu06u5kpd1vryy0p) (version source revid:jack@sun.com-20100302011538-xu06u5kpd1vryy0p) (merge vers: 5.1.41-ndb-7.0.14) (pib:16)
[2 Mar 2010 12:03]
Bugs System
A patch for this bug has been committed. After review, it may be pushed to the relevant source trees for release in the next version. You can access the patch from: http://lists.mysql.com/commits/102023 3475 Martin Skold 2010-03-02 [merge] Merge modified: storage/ndb/src/kernel/error/ErrorReporter.cpp
[3 Mar 2010 5:47]
Jon Stephens
Documented bugfix in the NDB-7.0.14 changelog as follows:
The internal ErrorReporter::formatMessage() method could in some cases
cause a buffer overflow.
Set to Need Merge since it appears this will need to be merged to 7.1 at some point.
Description: the call to formatMessage at storage\ndb\src\kernel\error\ErrorReporter.cpp:288 overflows the buffer, corrupting the 'stream' variable. i increased the size of the buffer like so: --- storage/ndb/src/kernel/error/ErrorReporter.cpp 2009-05-27 15:21:45 +0000 +++ storage/ndb/src/kernel/error/ErrorReporter.cpp 2009-09-04 05:10:45 +0000 @@ -31,7 +31,7 @@ #include <NdbAutoPtr.hpp> -#define MESSAGE_LENGTH 500 +#define MESSAGE_LENGTH 999 static int WriteMessage(int thrdMessageID, const char* thrdProblemData, and that temporarily fixes the problem. How to repeat: . Suggested fix: .