Bug #67472 packet len check missing/wrong on python 2.x
Submitted: 5 Nov 2012 9:30 Modified: 2 Oct 2014 12:24
Reporter: Christoph Thielecke Email Updates:
Status: Can't repeat Impact on me:
None 
Category:Connector / Python Severity:S3 (Non-critical)
Version:1.0.7, 1.0.8, 2.0.2 OS:Any
Assigned to: CPU Architecture:Any
Tags: Contribution, packet len, programming error

[5 Nov 2012 9:30] Christoph Thielecke
Description:
If something wrong with connection (here: unix socket) it can happen that invalid data recieved. The connector miss a check at one place and one is wrong.

<type 'exceptions.IndexError'>, string index out of range
  File "/usr/localmyapp/sql_func.py", line 856, in db_query
    c=cursor.execute(arg_query)

  File "/usr/lib/python2.5/site-packages/DBUtils-1.0-py2.5.egg/DBUtils/SteadyDB.py", line 447, in tough_method
    result = method(*args, **kwargs) # try to execute

  File "/usr/lib/python2.5/site-packages/mysql/connector/cursor.py", line 392, in execute
    self._handle_result(self._connection.cmd_query(stmt))

  File "/usr/lib/python2.5/site-packages/mysql/connector/connection.py", line 503, in cmd_query
    statement))

  File "/usr/lib/python2.5/site-packages/mysql/connector/connection.py", line 420, in _handle_result
    elif packet[4] == '\x00':

How to repeat:
let invalid data arrive via socket.

Suggested fix:
--- mysql-connector-python-1.0.7/python2/mysql/connector/connection.py.orig     2012-11-05 10:20:20.000000000 +0100
+++ mysql-connector-python-1.0.7/python2/mysql/connector/connection.py  2012-11-05 10:21:40.000000000 +0100
@@ -375,6 +375,7 @@

         Returns a dict()
         """
+        if len(packet) >= 5:
         if packet[4] == '\x00':
             ok = self._protocol.parse_ok(packet)
             self._toggle_have_next_result(ok['server_status'])
@@ -414,7 +415,7 @@

         Returns a dict()
         """
-        if not packet or len(packet) < 4:
+        if not packet or len(packet) < 5:
             raise errors.InterfaceError('Empty response')
         elif packet[4] == '\x00':
             return self._handle_ok(packet)
[24 Jan 2013 18:48] Sveta Smirnova
Thank you for the report.

Verified as described using code analysis.
[15 Feb 2013 14:06] Sveta Smirnova
Geert,

same code still exists in version 1.0.8
[2 Oct 2014 12:24] Geert Vanderkelen
Please reopen if issue is still seen with latest versions.