From 43632f4cd5f3fc7aaa9a0aa757081725f120c488 Mon Sep 17 00:00:00 2001 From: Anushree Prakash B Date: Fri, 8 Sep 2017 18:29:07 +0530 Subject: Bug#26372491 - RCE THROUGH THE MISHANDLE OF BACKSLASH DESCRIPTION: =========== The bug is related to incorrect parsing of SQL queries when typed in on the CLI. The incorrect parsing can result in unexpected results. ANALYSIS: ======== The scenarios mainly happens for identifier names with a typical combination of backslashes and backticks. The incorrect parsing can either result in executing additional queries or can result in query truncation. This can impact mysqldump as well. FIX: === The fix makes sure that such identifier names are correctly parsed and a proper query is sent to the server for execution. --- client/mysql.cc | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'client/mysql.cc') diff --git a/client/mysql.cc b/client/mysql.cc index d09499c120a..715d74f18b2 100644 --- a/client/mysql.cc +++ b/client/mysql.cc @@ -2119,7 +2119,10 @@ static bool add_line(String &buffer,char *line,char *in_string, if (*in_string || inchar == 'N') // \N is short for NULL { // Don't allow commands in string *out++='\\'; - *out++= (char) inchar; + if ((inchar == '`') && (*in_string == inchar)) + pos--; + else + *out++= (char) inchar; continue; } if ((com=find_command(NullS,(char) inchar))) -- cgit v1.2.1