• Karthik Kamath's avatar
    BUG#24437124: POSSIBLE BUFFER OVERFLOW ON CREATE TABLE · a63185e8
    Karthik Kamath authored
    ANALYSIS:
    =========
    'CREATE TABLE' query with a large value for 'CONNECTION'
    string reports an incorrect error.
    
    The length of connection string is stored in .frm in two
    bytes (max value= 65535). When the string length exceeds
    the max value, the length is truncated to fit the two
    bytes limit. Further processing leads to reading only a
    part of the string as the length stored is incorrect. The
    remaining part of the string is treated as engine type and
    hence results in an error.
    
    FIX:
    ====
    We are now restricting the connection string length to 1024.
    An appropriate error is reported if the length crosses this
    limit.
    
    NOTE:
    =====
    The 'PASSWORD' table option is documented as unused and
    processed within a dead code. Hence it will not cause
    similar issue with large strings.
    a63185e8
sql_table.cc 246 KB