Old style C functions `strcpy()`, `strcat()` and `sprintf()` are vulnerable to
security issues due to lacking memory boundary checks. Replace these in the
Connect storage engine with safe new and/or custom functions such as
`snprintf()` `safe_strcpy()` and `safe_strcat()`.
With this change FlawFinder and other static security analyzers report 287
fewer findings.
All new code of the whole pull request, including one or several files that are
either new files or modified ones, are contributed under the BSD-new license. I
am contributing on behalf of my employer Amazon Web Services, Inc.
This commit replaces sprintf(buf, ...) with
snprintf(buf, sizeof(buf), ...),
specifically in the "easy" cases where buf is allocated with a size
known at compile time.
The changes make sure we are not write outside array/string bounds which
will lead to undefined behaviour. In case the code is trying to write
outside bounds - safe version of functions simply cut the string
messages so we process this gracefully.
All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the BSD-new
license. I am contributing on behalf of my employer Amazon Web Services,
Inc.
bsonudf.cpp warnings cleanup by Daniel Black
Reviewer: Daniel Black
modified: sql/mysqld.h
modified: storage/connect/CMakeLists.txt
modified: storage/connect/javaconn.cpp
modified: storage/connect/mycat.cc
modified: storage/connect/mycat.h
- Get a handled on a not pooled client
This to avoid a .50 delay when closing
modified: storage/connect/cmgoconn.cpp
modified: storage/connect/cmgoconn.h
- Allow FIELD_FORMAT options for DECIMAL type
modified: storage/connect/tabdos.cpp
- Update tests and result to reflect last changes
Also because Oracle password has changed
modified: storage/connect/mysql-test/connect/r/jdbc_oracle.result
modified: storage/connect/mysql-test/connect/r/json_java_2.result
modified: storage/connect/mysql-test/connect/r/json_java_3.result
modified: storage/connect/mysql-test/connect/r/json_mongo_c.result
modified: storage/connect/mysql-test/connect/r/mongo_c.result
modified: storage/connect/mysql-test/connect/r/odbc_oracle.result
modified: storage/connect/mysql-test/connect/t/jdbc_oracle.test
modified: storage/connect/mysql-test/connect/t/odbc_oracle.test
- Typo
modified: storage/connect/reldef.cpp
- Limit decimals of doubles printed from MongoDB
Done in function Mini for Mongo C Driver and Java Driver
Done in function SerializeValue for Java tables using the J Driver
modified: storage/connect/cmgoconn.cpp
modified: storage/connect/json.cpp
modified: storage/connect/json.h
modified: storage/connect/tabjmg.cpp
- Fix crash when using BSON_TYPE_DECIMAL128
modified: storage/connect/cmgoconn.cpp
- Collection name default to table name
Fix it when creating tables via discovery
modified: storage/connect/ha_connect.cc
modified: storage/connect/tabbson.cpp
modified: storage/connect/tabjson.cpp
modified: storage/connect/ha_connect.cc
- Include MONGO in all Java enabled distributions
Mongo will be enabled only for 10.2 and 10.3
modified: storage/connect/CMakeLists.txt
- Change JDBC_SUPPORT to JAVA_SUPPORT which also replaces MONGO_SUPPORT
MONGO_SUPPORT is now just used to enable the MONGO table type
modified: storage/connect/filter.cpp
modified: storage/connect/ha_connect.cc
modified: storage/connect/ha_connect.h
modified: storage/connect/mongo.cpp
modified: storage/connect/mycat.cc
modified: storage/connect/plgdbutl.cpp
modified: storage/connect/tabjson.cpp
modified: storage/connect/tabjson.h
- Move MakeSelector function from FILTER to mongo.cpp
modified: storage/connect/filter.cpp
modified: storage/connect/filter.h
modified: storage/connect/cmgoconn.cpp
modified: storage/connect/jmgoconn.cpp
modified: storage/connect/mongo.cpp
- Do mongo_init only on first use of the MongoDB C Driver
This will permit to delay load the mongo lib on Windows
modified: storage/connect/cmgoconn.cpp
modified: storage/connect/cmgoconn.h
modified: storage/connect/ha_connect.cc
- Replace NEW_VAR by a test on MYSQL_VERSION_ID
modified: storage/connect/ha_connect.cc
- Suppress enable_mongo session variable
modified: storage/connect/ha_connect.cc
modified: storage/connect/mycat.cc
- Make some function headers identical in .h and .cc file
(replacing const char* by PCSZ)
modified: storage/connect/ha_connect.cc
modified: storage/connect/ha_connect.h
- Change a parameter type from uchar* to const uchar*
(for ScanRecord and CheckRecord)
modified: storage/connect/ha_connect.cc
modified: storage/connect/ha_connect.h
- Changes on LIKE and NOT LIKE does not fix a bug yet
modified: storage/connect/ha_connect.cc
- Suppress PIVOT_SUPPORT (PIVOT type is unconditionnal)
modified: storage/connect/ha_connect.cc
modified: storage/connect/mycat.cc
- Change the strz function from inline to static
modified: storage/connect/ha_connect.cc
modified: storage/connect/ha_connect.h
- export the JavaConn class and the MgoColumns and IsNum functions
modified: storage/connect/javaconn.h
modified: storage/connect/json.h
modified: storage/connect/mongo.h
- Fix MDEV-13924
modified: storage/connect/jdbconn.cpp
- Make a temporary fix for the compiler bug in CalculateArray
modified: storage/connect/jsonudf.cpp
modified: storage/connect/tabjson.cpp
- Typo
modified: storage/connect/jdbccat.h
modified: storage/connect/reldef.h
modified: storage/connect/tabext.h
modified: storage/connect/tabjmg.cpp
modified: storage/connect/tabxml.h
modified: storage/connect/valblk.h
modified: storage/connect/value.h
modified: storage/connect/xtable.h
- Fix a bug in MONGO tests by changing 'MONGO' to $TYPE
modified: storage/connect/mysql-test/connect/t/mongo_test.inc
- Record test results to reflect all changes
modified: storage/connect/mysql-test/connect/r/json_java_2.result
modified: storage/connect/mysql-test/connect/r/json_java_3.result
modified: storage/connect/mysql-test/connect/r/json_mongo_c.result
modified: storage/connect/mysql-test/connect/r/mongo_c.result
modified: storage/connect/mysql-test/connect/r/mongo_java_2.result
modified: storage/connect/mysql-test/connect/r/mongo_java_3.result
This to have automatic closing in case of thrown error.
modified: storage/connect/cmgoconn.cpp
modified: storage/connect/cmgoconn.h
modified: storage/connect/filamzip.cpp
modified: storage/connect/javaconn.cpp
modified: storage/connect/javaconn.h
modified: storage/connect/odbconn.cpp
modified: storage/connect/odbconn.h
modified: storage/connect/plgdbsem.h
modified: storage/connect/plgdbutl.cpp
- Fix INCOL bug when inserting several lines to MONGO tables
modified: storage/connect/cmgoconn.cpp
modified: storage/connect/tabcmg.cpp
modified: storage/connect/tabjmg.cpp
- MONGO_SUPPORT is set for both MongoDB drivers
CMGO_SUPPORT is set only when the C driver is available
modified: storage/connect/CMakeLists.txt
modified: storage/connect/filter.h
modified: storage/connect/filter.h
modified: storage/connect/ha_connect.cc
modified: storage/connect/mongo.cpp
modified: storage/connect/mycat.cc
modified: storage/connect/tabjson.cpp
modified: storage/connect/tabjson.h
- Separate enums JCATINFO and
modified: storage/connect/javaconn.h
modified: storage/connect/jdbconn.cpp
- Fix crash when executing JDBC catfunc=driver
modified: storage/connect/jdbconn.cpp
- Report an error when the Mongo driver if explicitly
specified and not supported.
modified: storage/connect/mongo.cpp
- Fix bug causing catalog JSON tables to fail
modified: storage/connect/tabjson.cpp
- Protect by mutex the Ready variable of the TBLTBM table type
modified: storage/connect/tabtbl.cpp
- Put testing of Thread TBL tables in a separate test
With added case and modified old case that could avoid the test to fail.
modified: storage/connect/mysql-test/connect/r/tbl.result
modified: storage/connect/mysql-test/connect/t/tbl.test
new file: storage/connect/mysql-test/connect/r/tbl_thread.result
new file: storage/connect/mysql-test/connect/t/tbl_thread.test
- jmongo3.test no more exists
deleted: storage/connect/mysql-test/connect/t/jmongo3.test
- Add new tests for the MONGO feature (disabled)
modified: storage/connect/mysql-test/connect/disabled.def
new file: storage/connect/mysql-test/connect/r/json_java_2.result
new file: storage/connect/mysql-test/connect/r/json_java_3.result
new file: storage/connect/mysql-test/connect/r/json_mongo_c.result
new file: storage/connect/mysql-test/connect/r/mongo_c.result
new file: storage/connect/mysql-test/connect/r/mongo_java_2.result
new file: storage/connect/mysql-test/connect/r/mongo_java_3.result
new file: storage/connect/mysql-test/connect/std_data/Mongo2.jar
new file: storage/connect/mysql-test/connect/std_data/cities.json
new file: storage/connect/mysql-test/connect/t/json_java_2.test
new file: storage/connect/mysql-test/connect/t/json_java_3.test
new file: storage/connect/mysql-test/connect/t/json_mongo_c.test
new file: storage/connect/mysql-test/connect/t/mongo.inc
new file: storage/connect/mysql-test/connect/t/mongo_c.test
new file: storage/connect/mysql-test/connect/t/mongo_java_2.test
new file: storage/connect/mysql-test/connect/t/mongo_java_3.test
new file: storage/connect/mysql-test/connect/t/mongo_test.inc
