Bug #93851 Buffer underflow in fix_paths

Submitted: 8 Jan 2019 12:15 Modified: 9 Jan 2019 7:55
Reporter: Zsolt Parragi (OCA) Email Updates:
Status: Verified Impact on me:
None 
Category:MySQL Server: Options Severity:S3 (Non-critical)
Version:5.7, not 8.0 OS:Any
Assigned to: CPU Architecture:Any

[8 Jan 2019 12:15] Zsolt Parragi
Description:
In sql/mysqld.cc:8371 (fix_paths function), the code checks if the mysql_home ends with LF_LIBCHAR. This test ignores the possibility that mysql_home can be an empty string, in which case it causes a buffer underflow.

This was already fixed in 8.0, by adding an additional condition.

How to repeat:
Found when backporting log encryption to 5.7, in the bootstrap command executed by log_encrypt_4 mtr testcase

Suggested fix:
Backport the additional condition from 8.0
[9 Jan 2019 7:36] Laurynas Biveinis
The commit to backport would be 

commit ce1fd349764018574ba6c7dc000dbc73279222bd
Author: Dyre Tjeldvoll <Dyre.Tjeldvoll@oracle.com>
Date:   Fri Apr 21 10:48:26 2017 +0200

    Bug#25914296: OUT-OF-BOUNDS READ IN MYSQLD.CC FIX_PATHS
    
    Problem: Using --basedir= would result in an out-of-bounds read ASAN
    error. Root cause was a failure to check if mysql_home is empty when
    checking if mysql_home ends with FN_LIBCHAR. The test used,
    strend(mysql_home)[-1]==FN_LIBCHAR, leads to out-of-bounds read when
    mysql_home is empty and strend(mysql_home)==mysql_home.
    
    Solution: Add a separate check for strend(mysql_home)==mysql_home.
[9 Jan 2019 7:55] MySQL Verification Team
Hello Zsolt Parragi,

Thank you for the report.

Thanks,
Umesh

Portions of this website are copyright © 2001, 2002 The PHP Group

Page generated in 0.038 sec. using MySQL 8.4.7-u6-cloud

Timestamp references displayed by the system are UTC.
Content reproduced on this site is the property of the respective copyright holders.
It is not reviewed in advance by Oracle and does not necessarily represent the opinion of Oracle or any other party.