mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 12:02:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Bug#28984: crasher on connect with out of range password length in \

Browse source 
protocol

Update for function moved to new file in 5.1.

One could send a malformed packet that caused the server to SEGV.  In 
recent versions of the password protocol, the client tells the server 
what length the ciphertext is (almost always 20).  If that length was
large enough to overflow a signed char, then the number would jump to 
very large after being casted to unsigned int.
  
Instead, cast the *passwd char to uchar.


sql/sql_connect.cc:
  Update for function moved to new file in 5.1.
This commit is contained in:
unknown 2007-06-11 16:03:05 -04:00
parent 67b33c810a
commit 46085513c1
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
sql/sql_connect.cc
View file

@ -837,9 +837,12 @@ static int check_connection(THD *thd)
password both send '\0'.
This strlen() can't be easily deleted without changing protocol.
Cast *passwd to an unsigned char, so that it doesn't extend the sign for
*passwd > 127 and become 2**32-127+ after casting to uint.
*/
uint passwd_len= thd->client_capabilities & CLIENT_SECURE_CONNECTION ?
*passwd++ : strlen(passwd);
(uchar)(*passwd++) : strlen(passwd);
db= thd->client_capabilities & CLIENT_CONNECT_WITH_DB ?
db + passwd_len + 1 : 0;
/* strlen() can't be easily deleted without changing protocol */