• Dmitry Lenev's avatar
    Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE · 1874591d
    Dmitry Lenev authored
    ROBUST AGAINST BUGS IN CALLERS".
    
    Both MDL subsystems and Table Definition Cache code assume
    that callers ensure that names of objects passed to them are
    not longer than NAME_LEN bytes. Unfortunately due to bugs in
    callers this assumption might be broken in some cases. As
    result we get nasty bugs causing buffer overruns when we
    construct MDL key or TDC key from object names.
    
    This patch makes MDL and TDC code more robust against such
    bugs by ensuring that we always checking size of result
    buffer when constructing MDL and TDC keys. This doesn't
    free its callers from ensuring that both db and table names
    are shorter than NAME_LEN bytes. But at least these steps
    prevents buffer overruns in case of bug in caller, replacing
    them with less harmful behavior.
    
    This is 5.5-only version of patch.
    
    Changed code of MDL_key::mdl_key_init() to take into account
    size of buffer for the key.
    
    Introduced new version of create_table_def_key() helper function
    which constructs TDC key without risk of result buffer overrun.
    Places in code that construct TDC keys were changed to use this
    function.
    
    Also changed rm_temporary_table() and open_new_frm() functions
    to avoid use of "unsafe" strmov() and strxmov() functions and
    use safer strnxmov() instead.
    1874591d
sql_base.cc 304 KB