mirror of
https://github.com/MariaDB/server.git
synced 2025-01-18 21:12:26 +01:00
b27fd90ad3
TOCTOU bug. The path is checked to be valid, symlinks are resolved. Then the resolved path is opened. Between the check and the open, there's a window when one can replace some path component with a symlink, bypassing validity checks. Fix: after we resolved all symlinks in the path, don't allow open() to resolve symlinks, there should be none. Compared to the old MyISAM/Aria code: * fastpath. Opening of not-symlinked files is just one open(), no fn_format() and lstat() anymore. * opening of symlinked tables doesn't do fn_format() and lstat() either. it also doesn't to realpath() (which was lstat-ing every path component), instead if opens every path component with O_PATH. * share->data_file_name stores realpath(path) not readlink(path). So, SHOW CREATE TABLE needs to do lstat/readlink() now (see ::info()), and certain error messages (cannot open file "XXX") show the real file path with all symlinks resolved.
26 lines
825 B
Text
26 lines
825 B
Text
#
|
|
# MDEV-5543 MyISAM repair unsafe usage of TMD files
|
|
#
|
|
--source include/have_symlink.inc
|
|
--source include/not_windows.inc
|
|
--source include/have_maria.inc
|
|
|
|
--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
|
|
eval create table t1 (a int) engine=myisam data directory='$MYSQL_TMP_DIR';
|
|
insert t1 values (1);
|
|
--system ln -s $MYSQL_TMP_DIR/foobar5543 $MYSQL_TMP_DIR/t1.TMD
|
|
--replace_regex / '.*\/t1/ 'MYSQL_TMP_DIR\/t1/
|
|
repair table t1;
|
|
drop table t1;
|
|
|
|
--replace_result $MYSQL_TMP_DIR MYSQL_TMP_DIR
|
|
eval create table t2 (a int) engine=aria data directory='$MYSQL_TMP_DIR';
|
|
insert t2 values (1);
|
|
--system ln -s $MYSQL_TMP_DIR/foobar5543 $MYSQL_TMP_DIR/t2.TMD
|
|
--replace_regex / '.*\/t2/ 'MYSQL_TMP_DIR\/t2/
|
|
repair table t2;
|
|
drop table t2;
|
|
|
|
--list_files $MYSQL_TMP_DIR foobar5543
|
|
--system rm $MYSQL_TMP_DIR/t1.TMD $MYSQL_TMP_DIR/t2.TMD
|
|
|