Commit 35313020 authored by Vladislav Vaintroub's avatar Vladislav Vaintroub

MDEV-3849 - 1 bytes stack overwrite in normalize_dirname().

Take into account that length of strings passed down to this function can be up to FN_REFLEN+1 bytes. including terminating zero.
The overwrite was caused by incomplete fix to MySQL Bug # 44834
parent 8db07274
...@@ -35,7 +35,7 @@ void pack_dirname(char * to, const char *from) ...@@ -35,7 +35,7 @@ void pack_dirname(char * to, const char *from)
int cwd_err; int cwd_err;
size_t d_length,length,UNINIT_VAR(buff_length); size_t d_length,length,UNINIT_VAR(buff_length);
char * start; char * start;
char buff[FN_REFLEN]; char buff[FN_REFLEN + 1];
DBUG_ENTER("pack_dirname"); DBUG_ENTER("pack_dirname");
(void) intern_filename(to,from); /* Change to intern name */ (void) intern_filename(to,from); /* Change to intern name */
...@@ -132,7 +132,7 @@ size_t cleanup_dirname(register char *to, const char *from) ...@@ -132,7 +132,7 @@ size_t cleanup_dirname(register char *to, const char *from)
reg3 char * from_ptr; reg3 char * from_ptr;
reg4 char * start; reg4 char * start;
char parent[5], /* for "FN_PARENTDIR" */ char parent[5], /* for "FN_PARENTDIR" */
buff[FN_REFLEN+1],*end_parentdir; buff[FN_REFLEN + 1],*end_parentdir;
#ifdef BACKSLASH_MBTAIL #ifdef BACKSLASH_MBTAIL
CHARSET_INFO *fs= fs_character_set(); CHARSET_INFO *fs= fs_character_set();
#endif #endif
...@@ -245,7 +245,7 @@ my_bool my_use_symdir=0; /* Set this if you want to use symdirs */ ...@@ -245,7 +245,7 @@ my_bool my_use_symdir=0; /* Set this if you want to use symdirs */
#ifdef USE_SYMDIR #ifdef USE_SYMDIR
void symdirget(char *dir) void symdirget(char *dir)
{ {
char buff[FN_REFLEN+1]; char buff[FN_REFLEN + 1];
char *pos=strend(dir); char *pos=strend(dir);
if (dir[0] && pos[-1] != FN_DEVCHAR && my_access(dir, F_OK)) if (dir[0] && pos[-1] != FN_DEVCHAR && my_access(dir, F_OK))
{ {
...@@ -295,7 +295,7 @@ void symdirget(char *dir) ...@@ -295,7 +295,7 @@ void symdirget(char *dir)
size_t normalize_dirname(char *to, const char *from) size_t normalize_dirname(char *to, const char *from)
{ {
size_t length; size_t length;
char buff[FN_REFLEN]; char buff[FN_REFLEN + 1];
DBUG_ENTER("normalize_dirname"); DBUG_ENTER("normalize_dirname");
/* /*
...@@ -423,7 +423,7 @@ static char * NEAR_F expand_tilde(char * *path) ...@@ -423,7 +423,7 @@ static char * NEAR_F expand_tilde(char * *path)
size_t unpack_filename(char * to, const char *from) size_t unpack_filename(char * to, const char *from)
{ {
size_t length, n_length, buff_length; size_t length, n_length, buff_length;
char buff[FN_REFLEN]; char buff[FN_REFLEN + 1];
DBUG_ENTER("unpack_filename"); DBUG_ENTER("unpack_filename");
length=dirname_part(buff, from, &buff_length);/* copy & convert dirname */ length=dirname_part(buff, from, &buff_length);/* copy & convert dirname */
...@@ -459,7 +459,7 @@ size_t system_filename(char * to, const char *from) ...@@ -459,7 +459,7 @@ size_t system_filename(char * to, const char *from)
int libchar_found; int libchar_found;
size_t length; size_t length;
char * to_pos,from_pos,pos; char * to_pos,from_pos,pos;
char buff[FN_REFLEN]; char buff[FN_REFLEN + 1];
DBUG_ENTER("system_filename"); DBUG_ENTER("system_filename");
libchar_found=0; libchar_found=0;
...@@ -516,7 +516,7 @@ size_t system_filename(char * to, const char *from) ...@@ -516,7 +516,7 @@ size_t system_filename(char * to, const char *from)
char *intern_filename(char *to, const char *from) char *intern_filename(char *to, const char *from)
{ {
size_t length, to_length; size_t length, to_length;
char buff[FN_REFLEN]; char buff[FN_REFLEN + 1];
if (from == to) if (from == to)
{ /* Dirname may destroy from */ { /* Dirname may destroy from */
strmov(buff,from); strmov(buff,from);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment