• cmiller@zippy.cornsilk.net's avatar
    Bug#17583: mysql drops connection when stdout is not writable · 4812d81e
    cmiller@zippy.cornsilk.net authored
    When the client program had its stdout file descriptor closed by the calling
    shell, after some amount of work (enough to fill a socket buffer) the server 
    would complain about a packet error and then disconnect the client.
    
    This is a serious security problem.  If stdout is closed before the mysql is
    exec()d, then the first socket() call allocates file number 1 to communicate
    with the server.  Subsequent write()s to that file number (as when printing
    results that come back from the database) go back to the server instead in 
    the command channel.  So, one should be able to craft data which, upon being
    selected back from the server to the client, and injected into the command
    stream become valid MySQL protocol to do something nasty when sent /back/ to 
    the server.
    
    The solution is to close explicitly the file descriptor that we *printf() to, 
    so that the libc layer and the OS layer both agree that the file is closed.
    4812d81e
mysql.cc 95.3 KB