mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 12:02:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for BUG#15948580 UPDATE_XML() CRASHES THE SERVER.

Browse source 
Problem: tag's buffer overflow leads to a problem.
Fix: bound check added.


sql/item_xmlfunc.cc:
  Fix for BUG#15948580 UPDATE_XML() CRASHES THE SERVER.
  
    - XML tag/attribute level shouldn't exceed MAX_LEVEL as we use a
  static buffer to store them in the MY_XML_USER_DATA.
This commit is contained in:
Ramil Kalimullin 2012-12-14 13:55:30 +04:00
parent 117e2d1b6b
commit 0fa867fd91
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
sql/item_xmlfunc.cc
View file

@ -2669,8 +2669,12 @@ int xml_enter(MY_XML_PARSER *st,const char *attr, size_t len)
node.parent= data->parent; // Set parent for the new node to old parent
data->parent= numnodes; // Remember current node as new parent
DBUG_ASSERT(data->level <= MAX_LEVEL);
data->pos[data->level]= numnodes;
node.level= data->level++;
if (data->level < MAX_LEVEL)
node.level= data->level++;
else
return MY_XML_ERROR;
node.type= st->current_node_type; // TAG or ATTR
node.beg= attr;
node.end= attr + len;