1. 01 Dec, 2008 1 commit
  2. 27 Nov, 2008 1 commit
  3. 26 Jul, 2008 1 commit
    • Alexey Botchkov's avatar
      Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY. · 966e03e2
      Alexey Botchkov authored
            
            test_if_data_home_dir fixed to look into real path.
            Checks added to mi_open for symlinks into data home directory.
      modified:
        include/my_sys.h
        include/myisam.h
        myisam/mi_check.c
        myisam/mi_open.c
        myisam/mi_static.c
        myisam/myisamchk.c
        myisam/myisamdef.h
        mysql-test/r/symlink.result
        mysys/my_symlink.c
        sql/mysql_priv.h
        sql/mysqld.cc
        sql/sql_parse.cc
      
      per-file messages:
        include/my_sys.h
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          my_is_symlink interface added
        include/myisam.h
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          myisam_test_invalid_symlink interface added
        myisam/mi_check.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          mi_open_datafile calls modified
        myisam/mi_open.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          code added to mi_open to check for symlinks into data home directory.
          mi_open_datafile now accepts 'original' file path to check if it's
          an allowed symlink.
        myisam/mi_static.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          myisam_test_invlaid_symlink defined
        myisam/myisamchk.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          mi_open_datafile call modified
        myisam/myisamdef.h
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          mi_open_datafile interface modified - 'real_path' parameter added
        mysql-test/r/symlink.test
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          error codes corrected as some patch now rejected pointing inside datahome
        mysql-test/r/symlink.result
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          error messages corrected in the result
        mysys/my_symlink.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          my_is_symlink() implementsd
          my_realpath() now returns the 'realpath' even if a file isn't a symlink
        sql/mysql_priv.h
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          test_if_data_home_dir interface
        sql/mysqld.cc
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          myisam_test_invalid_symlik set with the 'test_if_data_home_dir'
        sql/sql_parse.cc
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          error messages corrected
          test_if_data_home_dir code fixed
      966e03e2
  4. 11 Jun, 2008 1 commit
  5. 21 May, 2008 1 commit
  6. 22 Mar, 2008 1 commit
  7. 19 Mar, 2008 3 commits
  8. 17 Mar, 2008 2 commits
  9. 14 Mar, 2008 1 commit
  10. 12 Mar, 2008 1 commit
  11. 01 Mar, 2008 1 commit
    • unknown's avatar
      mysql.spec.sh: · 19a2e5a2
      unknown authored
        - Aligned copyright headers and text with 5.0
        - Don't strip binaries on SuSE 9
        - Formatting alignment with spec file in 5.0
        - Run full test on "normal" binary, and less on "Max"
        - Let test runs on "Max" identify the runs with "max" and "max+ps"
      
      
      support-files/mysql.spec.sh:
        - Aligned copyright headers and text with 5.0
        - Don't strip binaries on SuSE 9
        - Formatting alignment with spec file in 5.0
        - Run full test on "normal" binary, and less on "Max"
        - Let test runs on "Max" identify the runs with "max" and "max+ps"
      19a2e5a2
  12. 29 Feb, 2008 2 commits
    • unknown's avatar
      test fix · be59a0ea
      unknown authored
      
      mysql-test/r/symlink.result:
        result fix
      be59a0ea
    • unknown's avatar
      Bug#32167 another privilege bypass with DATA/INDEX DIRECORY(ver 4.1,5.0) · ab604259
      unknown authored
      added new function test_if_data_home_dir() which checks that
      path does not contain mysql data home directory.
      Using of mysql data home directory in
      DATA DIRECTORY & INDEX DIRECTORY is disallowed.
      
      
      mysql-test/r/symlink.result:
        test result
      mysql-test/t/symlink.test:
        test case
      sql/mysql_priv.h:
        new variable mysql_unpacked_real_data_home
      sql/mysqld.cc:
        new variable mysql_unpacked_real_data_home
      sql/sql_parse.cc:
        added new function test_if_data_home_dir() which checks that
        path does not contain mysql data home directory.
        Using of mysql data home directory in
        DATA DIRECTORY & INDEX DIRECTORY is disallowed.
      ab604259
  13. 26 Feb, 2008 1 commit
    • unknown's avatar
      configure.in: · b93e09a2
      unknown authored
        Corrected calculation of version id, incorrect last two digits if < 10
        Keep "sp1" or "a" in MYSQL_NO_DASH_VERSION, to set correct version in
        RPM spec file
        Added MYSQL_NUMERIC_VERSION that is like MYSQL_NO_DASH_VERSION before
        Added clear doc how the different version variables differ
      SocketServer.cpp:
        Corrected typo in debug error message
      
      
      ndb/src/common/util/SocketServer.cpp:
        Corrected typo in debug error message
      configure.in:
        Corrected calculation of version id, incorrect last two digits if < 10
        Keep "sp1" or "a" in MYSQL_NO_DASH_VERSION, to set correct version in
        RPM spec file
        Added MYSQL_NUMERIC_VERSION that is like MYSQL_NO_DASH_VERSION before
        Added clear doc how the different version variables differ
      b93e09a2
  14. 17 Feb, 2008 1 commit
  15. 10 Feb, 2008 1 commit
    • unknown's avatar
      Bug #33796 Memory leak for prepared statements in embedded server. · db66526c
      unknown authored
      Field data for a query was stored to the stmt->alloc that is emptied
      with mysql_stmt_close statement only. That means a lot of memory can
      be occupied without a reason if used doesn't call mysql_stmt_close often.
      
      
      libmysql/libmysql.c:
        Bug #33796 Memory leak for prepared statements in embedded server.
        
        Clean up result->alloc even if there's no 'data' created
      libmysqld/lib_sql.cc:
        Bug #33796 Memory leak for prepared statements in embedded server.
        
        alloc 'fields' in the 'result.alloc' as the 'mem_root' is only cleaned with
        mysql_stmt_close'
      db66526c
  16. 31 Jan, 2008 1 commit
  17. 29 Jan, 2008 1 commit
  18. 28 Jan, 2008 1 commit
  19. 25 Jan, 2008 1 commit
    • unknown's avatar
      Bug#33841: mysql client crashes when returning results for long-\ · 60ea77d4
      unknown authored
      	running queries
      
      Bug#33976: buffer overflow of variable time_buff in function com_go()
      
      An internal buffer was too short.  Overextending could smash the 
      stack on some architectures and cause SEGVs.  This is not a problem
      that could be exploited to run arbitrary code.
      
      To fix, I expanded one buffer to cover all the size that could be
      written to (we know the abolute max).
      
      
      client/mysql.cc:
        Bump up the max size of the time-elapsed buffer displayed at the end
        of queries.
      60ea77d4
  20. 22 Jan, 2008 1 commit
  21. 21 Jan, 2008 1 commit
  22. 03 Jan, 2008 2 commits
  23. 27 Dec, 2007 1 commit
    • unknown's avatar
      scripts/make_binary_distribution.sh: · 07aab86f
      unknown authored
      Fix the code to get the "libgcc" file name so that the failure of Intel's ICC
      to provide this information does not cause any problems.
      
      This fixes  bug#33536  Option "--print-libgcc-file" does not work with ICC compiler
      
      
      scripts/make_binary_distribution.sh:
        The (old) code to get the "libgcc" file name does not really work when using Intel's ICC.
        ICC accepts the "--print-libgcc-file" option but ignores it, does not produce any output.
        
        However, ICC tricks automake into taking it for a GCC ("GXX" variable is set, see
        http://www.gnu.org/software/autoconf/manual/html_node/C_002b_002b-Compiler.html#C_002b_002b-Compiler
        and its discussion of the "AC_PROG_CXX" macro).
        
        There are two possible approaches:
        a) Check "$CC" or "$CXX" to tell ICC from GCC, and do not ask ICC for the "libgcc" file name.
        b) Just ask it, but protect that code so that its failure does not cause any damage.
        
        This patch takes the second route:
        1) Put the call "@CC@ ... --print-libgcc-file" into a pipeline, followed by "|| true",
           so that (for the shell semantics) the command cannot fail.
           (ICC will exit non-zero because it is not given a source file.)
        2) Explicitly redirect any error messages.
        3) Do not use the compiler's return code but rather the (non)empty variable to check success.
        4) Ensure that the contents really is a file before taking it as a file name.
        
        Item 1) is especially important when the tool gets a "set -e" (this happens in 5.1, currently)
        which would make the failing compiler call a fatal thing.
        
        This fixes  bug#33536  Option "--print-libgcc-file" does not work with ICC compiler
      07aab86f
  24. 17 Dec, 2007 3 commits
  25. 13 Dec, 2007 1 commit
  26. 10 Dec, 2007 2 commits
    • unknown's avatar
      Merge tsmith@bk-internal.mysql.com:/home/bk/mysql-4.1-bug15815 · d802c0ac
      unknown authored
      into  ramayana.hindu.god:/home/tsmith/m/bk/maint/41
      
      
      innobase/buf/buf0buf.c:
        Auto merged
      innobase/buf/buf0flu.c:
        Auto merged
      innobase/buf/buf0lru.c:
        Auto merged
      innobase/include/buf0buf.h:
        Auto merged
      innobase/include/buf0buf.ic:
        Auto merged
      innobase/include/sync0arr.h:
        Auto merged
      innobase/include/sync0rw.h:
        Auto merged
      innobase/include/sync0rw.ic:
        Auto merged
      innobase/include/sync0sync.h:
        Auto merged
      innobase/os/os0sync.c:
        Auto merged
      innobase/sync/sync0arr.c:
        Auto merged
      innobase/sync/sync0rw.c:
        Auto merged
      innobase/sync/sync0sync.c:
        Auto merged
      mysql-test/mysql-test-run.pl:
        Auto merged
      d802c0ac
    • unknown's avatar
      Merge pippilotta.erinye.com:/shared/home/df/mysql/build/mysql-4.1 · 069ca6d0
      unknown authored
      into  pippilotta.erinye.com:/shared/home/df/mysql/build/mysql-4.1-build
      
      
      069ca6d0
  27. 06 Dec, 2007 2 commits
  28. 05 Dec, 2007 1 commit
  29. 01 Dec, 2007 2 commits
  30. 30 Nov, 2007 1 commit