Bug #88703 MySQL 5.7.20 contains a potential buffer overflow
Submitted: 29 Nov 2017 21:44 Modified: 15 Dec 2017 6:47
Reporter: Björn Voigt (OCA) Email Updates:
Status: Duplicate Impact on me:
None 
Category:MySQL Server: Compiling Severity:S3 (Non-critical)
Version:5.7.20 OS:Any
Assigned to: CPU Architecture:Any

[29 Nov 2017 21:44] Björn Voigt
Description:
GCC 7 reports a warning/error here:

[ 47%] Building CXX object sql/CMakeFiles/sql.dir/sys_vars.cc.o
In file included from /usr/src/packages/BUILD/mysql-5.7.20/mysql-5.7.20/sql/sys_vars.cc:33:0:
/usr/src/packages/BUILD/mysql-5.7.20/mysql-5.7.20/sql/sys_vars.h: In member function ‘virtual bool Sys_var_gtid_mode::global_update(THD*, set_var*)’:
/usr/src/packages/BUILD/mysql-5.7.20/mysql-5.7.20/sql/sys_vars.h:2701:8: error: ‘' before you set @@GLOBAL.GTID_MODE = OFF.’ directive writing 42 bytes into a region of size between 5 and 389 [-Werror=format-overflow=]
   bool global_update(THD *thd, set_var *var)
        ^~~~~~~~~~~~~
/usr/src/packages/BUILD/mysql-5.7.20/mysql-5.7.20/sql/sys_vars.h:2771:18: note: ‘sprintf’ output between 166 and 550 bytes into a destination of size 512
           sprintf(buf, "replication channel '%.192s' is configured "
           ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                   "in AUTO_POSITION mode. Execute "
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                   "CHANGE MASTER TO MASTER_AUTO_POSITION = 0 "
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                   "FOR CHANNEL '%.192s' before you set "
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                   "@@GLOBAL.GTID_MODE = OFF.",
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                   mi->get_channel(), mi->get_channel());
                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1plus: all warnings being treated as errors

This code may contain two bugs. First, the buffer is too small as GCC reports. Second, channel names can be up to 64 (Unicode) characters long. 192 in "%.192s" is 3*64. If the name contains only 4-byte names, then the name buffer must be 4*64+1 = 257 bytes long.

How to repeat:
Compile version 5.7.20 with GCC 7 and the following compile switches (only some of them are necessary to show the problem):

-m64 -fmessage-length=0   -fstack-protector -funwind-tables -fasynchronous-unwind-tables -Wno-implicit-fallthrough -Wno-int-in-bool-context -fPIC -Wall -Wextra -Wformat-security -Wvla -Woverloaded-virtual -Wno-unused-parameter -Werror -g -fabi-version=2 -fno-omit-frame-pointer -fno-strict-aliasing -std=gnu++03 

Suggested fix:
Increate the buffer length.
[8 Dec 2017 12:12] MySQL Verification Team
Hello Björn Voigt,

Thank you for the bug report and feedback!

Thanks,
Umesh
[8 Dec 2017 12:14] MySQL Verification Team
Build log

Attachment: 88703.build.log (text/x-log), 395.68 KiB.

[14 Dec 2017 14:02] Tor Didriksen
Posted by developer:
 
Fixed by patch for Bug#26825211
https://bugs.mysql.com/bug.php?id=87799
[15 Dec 2017 6:47] Erlend Dahl
Duplicate of Bug#87799 Backport fix for #25643811 to 5.7