Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix crash on malformed packet received from MySQL - Port of #4742 #4743

Merged
merged 2 commits into from
Nov 11, 2024
+404 −0
Merged

Fix crash on malformed packet received from MySQL - Port of #4742 #4743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0277b04
Crash fix: Add integrity check for 'column-count' packet to 'libmaria…
JavierJF Nov 6, 2024
32dfd0e
Add regression test for 'column-count' integrity check in 'libmariadb…
JavierJF Nov 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions deps/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,6 +237,7 @@ endif
# patches for replication testing
cd mariadb-client-library/mariadb_client && patch -p0 < ../mariadb_rpl.patch
cd mariadb-client-library/mariadb_client && patch -p0 < ../cmakelists.txt.patch
cd mariadb-client-library/mariadb_client && patch -p0 < ../mariadb_lib.c.metadata_column_check.patch
cd mariadb-client-library/mariadb_client && CC=${CC} CXX=${CXX} ${MAKE} mariadbclient
# cd mariadb-client-library/mariadb_client/include && make my_config.h

Expand Down
31 changes: 31 additions & 0 deletions deps/mariadb-client-library/mariadb_lib.c.metadata_column_check.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
diff --git libmariadb/mariadb_lib.c libmariadb/mariadb_lib.c
index 027167f1..58b8283a 100644
--- libmariadb/mariadb_lib.c
+++ libmariadb/mariadb_lib.c
@@ -3021,6 +3021,12 @@ MYSQL_FIELD *ma_duplicate_resultset_metadata(MYSQL_FIELD *fields, size_t count,
return result;
}

+static uint8_t mysql_encode_length(uint64_t len) {
+ if (len < 251) { return 1; }
+ if (len < 65536) { return 3; }
+ if (len < 16777216) { return 4; }
+ return 9;
+}

int mthd_my_read_query_result(MYSQL *mysql)
{
@@ -3070,6 +3076,13 @@ get_info:

if (has_metadata)
{
+ // integrity-check: the length encoding of the field count from 'column-count' packet
+ // must match the packet length from header, otherwise packet is malformed.
+ ulong enc_len = mysql_encode_length(field_count);
+ if (enc_len != length) {
+ my_set_error(mysql, CR_MALFORMED_PACKET, SQLSTATE_UNKNOWN, 0);
+ return -1;
+ }
// read packet metadata
mysql->fields =
mthd_my_read_metadata(mysql, field_count, 7 + ma_extended_type_info_rows(mysql));
Loading