mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-05-02 21:25:36 +02:00
Code Issues Projects Releases Packages Wiki Activity

Bug #35087: Inserting duplicate values at one time with DES_ENCRYPT leads

Browse source 
to wrong results
      
3 problems found with DES_ENCRYPT/DES_DECRYPT :

1. The max length was not calculated properly. Fixed in fix_length_and_dec()
2. DES_ENCRYPT had a side effect of sometimes reallocating and changing 
the value of its argument. Fixed by explicitly pre-allocating the necessary
space to pad the argument with trailing '*' (stars) when calculating the 
DES digest.
3. in DES_ENCRYPT the string buffer for the result value was not 
reallocated to the correct size and only string length was assigned to it. 
Fixed by making sure there's enough space to hold the result.
This commit is contained in:
Georgi Kodinov 2009-04-17 18:52:57 +03:00
commit 0804479569
4 changed files with 82 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

12
sql/item_strfunc.cc
View file

@ -473,17 +473,21 @@ String *Item_func_des_encrypt::val_str(String *str)
string marking change of string length.
*/
tail= (8-(res_length) % 8); // 1..8 marking extra length
tail= 8 - (res_length % 8); // 1..8 marking extra length
res_length+=tail;
tmp_arg.realloc(res_length);
tmp_arg.length(0);
tmp_arg.append(res->ptr(), res->length());
code= ER_OUT_OF_RESOURCES;
if (tail && res->append(append_str, tail) || tmp_value.alloc(res_length+1))
if (tmp_arg.append(append_str, tail) || tmp_value.alloc(res_length+1))
goto error;
(*res)[res_length-1]=tail; // save extra length
tmp_arg[res_length-1]=tail; // save extra length
tmp_value.realloc(res_length+1);
tmp_value.length(res_length+1);
tmp_value[0]=(char) (128 | key_number);
// Real encryption
bzero((char*) &ivec,sizeof(ivec));
DES_ede3_cbc_encrypt((const uchar*) (res->ptr()),
DES_ede3_cbc_encrypt((const uchar*) (tmp_arg.ptr()),
(uchar*) (tmp_value.ptr()+1),
res_length,
&keyschedule.ks1,