mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-05-15 03:17:20 +02:00
Code Issues Projects Releases Packages Wiki Activity

MDEV-36230 Fix SERVER port field bound check

Browse source 
The Port field in the system table mysql.servers has type INT,
which translates to Field_long.

During parsing it is parsed as ulong_num, and in this patch we add
bound checks there.
This commit is contained in:
Yuchen Pei 2026-01-23 15:31:46 +11:00
commit 8070033e47
No known key found for this signature in database
GPG key ID: 3DD1B35105743563
3 changed files with 58 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
mysql-test/main/servers.result
View file

@ -104,4 +104,26 @@ uninstall soname "ha_example";
ERROR HY000: Cannot load from mysql.plugin. The table is probably corrupted
drop table mysql.plugin;
rename table mysql.plugin_save to mysql.plugin;
#
# MDEV-36230 SIGSEGV in store_server_fields on CREATE SERVER
#
## Error code depends on length of long
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT 4294967295);
ERROR 22003: port value is out of range in 'INT'
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT 2147483647);
select * from mysql.servers;
Server_name Host Db Username Password Port Socket Wrapper Owner
s 2147483647 mysql
ALTER SERVER s OPTIONS (PORT 4294967295);
ERROR 22003: port value is out of range in 'INT'
select * from mysql.servers;
Server_name Host Db Username Password Port Socket Wrapper Owner
s 2147483647 mysql
drop server s;
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT 2147483648);
ERROR 22003: port value is out of range in 'INT'
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT 18446744073709551615);
ERROR 22003: port value is out of range in 'INT'
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT -5);
ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '-5)' at line 1
# End of 10.11 tests

20
mysql-test/main/servers.test
View file

@ -112,4 +112,24 @@ uninstall soname "ha_example";
drop table mysql.plugin;
rename table mysql.plugin_save to mysql.plugin;
--echo #
--echo # MDEV-36230 SIGSEGV in store_server_fields on CREATE SERVER
--echo #
--echo ## Error code depends on length of long
--error ER_DATA_OUT_OF_RANGE
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT 4294967295);
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT 2147483647);
select * from mysql.servers;
--error ER_DATA_OUT_OF_RANGE
ALTER SERVER s OPTIONS (PORT 4294967295);
select * from mysql.servers;
drop server s;
--error ER_DATA_OUT_OF_RANGE
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT 2147483648);
--error ER_DATA_OUT_OF_RANGE
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT 18446744073709551615);
--error ER_PARSE_ERROR
CREATE SERVER s FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',PORT -5);
--echo # End of 10.11 tests

16
sql/sql_yacc.yy
View file

@ -2873,6 +2873,22 @@ server_option:
}
| PORT_SYM ulong_num
{
/*
We especially don't want this to happen:
The value of $2 is ULONG_MAX, causing
server_options.port to be -1, which means "default
port".
Because we are doing a check here, we may as well check
against the SQL data type in one go rather than just the
C++ type here and SQL type later in sql_servers.cc.
*/
if ($2 > INT32_MAX)
{
my_error(ER_DATA_OUT_OF_RANGE, myf(0), "port", "INT");
MYSQL_YYABORT;
}
Lex->server_options.port= $2;
}
;