mirror of
https://github.com/MariaDB/server.git
synced 2025-01-20 14:02:32 +01:00
a432d3dec4
When running mysqlbinlog on a 64-bit machine with a corrupt relay log, it causes mysqlbinlog to crash. In this case, the crash is caused because a request for 18446744073709534806U bytes is issued, which apparantly can be served on a 64-bit machine (speculatively, I assume) but this causes the memcpy() issued later to copy the data to segfault. The request for the number of bytes is caused by a computation of data_len - server_vars_len where server_vars_len is corrupt in such a sense that it is > data_len. This causes a wrap-around, with the the data_len given above. This patch adds a check that if server_vars_len is greater than data_len before the substraction, and aborts reading the event in that case marking the event as invalid. It also adds checks to see that reading the server variables does not go outside the bounds of the available space, giving a limited amount of integrity check. |
||
|---|---|---|
| .. | ||
| ndb_backup50_data_be | ||
| ndb_backup50_data_le | ||
| 14897.frm | ||
| bad_gis_data.dat | ||
| bug15328.cnf | ||
| bug16266.000001 | ||
| bug19371.frm | ||
| bug19371.MYD | ||
| bug19371.MYI | ||
| cacert.pem | ||
| client-cert.pem | ||
| client-key.pem | ||
| corrupt-relay-bin.000624 | ||
| des_key_file | ||
| Index.xml | ||
| init_file.dat | ||
| loaddata1.dat | ||
| loaddata2.dat | ||
| loaddata3.dat | ||
| loaddata4.dat | ||
| loaddata5.dat | ||
| loaddata6.dat | ||
| loaddata_dq.dat | ||
| loaddata_pair.dat | ||
| master-bin.000001 | ||
| Moscow_leap | ||
| ndb_config_mycnf1.cnf | ||
| ndb_config_mycnf2.cnf | ||
| rpl_loaddata.dat | ||
| rpl_loaddata2.dat | ||
| rpl_timezone.dat | ||
| server-cert-des.pem | ||
| server-cert.pem | ||
| server-key-des.pem | ||
| server-key.pem | ||
| server8k-cert.pem | ||
| server8k-key.pem | ||
| trunc_binlog.000001 | ||
| untrusted-cacert.pem | ||
| vchar.frm | ||
| warnings_loaddata.dat | ||
| words.dat | ||