From 5cfe52314e29386e1867fad1b44eace2b9d0be7e Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Fri, 27 Apr 2018 11:21:55 +0200 Subject: Bug#25471090: MYSQL USE AFTER FREE fix another similar line followup for 7828ba0df488 --- sql-common/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sql-common/client.c') diff --git a/sql-common/client.c b/sql-common/client.c index bb7bdb1ff7d..9cb3311d2e1 100644 --- a/sql-common/client.c +++ b/sql-common/client.c @@ -1636,7 +1636,7 @@ MYSQL_DATA *cli_read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields, else { cur->data[field] = to; - if (len > (ulong) (end_to - to)) + if (to + len > end_to) { free_rows(result); set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate); -- cgit v1.2.1 From a52c46e06935b09ff9219ae7684b5a29394e992b Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Mon, 30 Apr 2018 13:50:59 +0200 Subject: Bug#25471090: MYSQL USE AFTER FREE a better fix --- sql-common/client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sql-common/client.c') diff --git a/sql-common/client.c b/sql-common/client.c index 9cb3311d2e1..b485ebf4f60 100644 --- a/sql-common/client.c +++ b/sql-common/client.c @@ -1636,7 +1636,7 @@ MYSQL_DATA *cli_read_rows(MYSQL *mysql,MYSQL_FIELD *mysql_fields, else { cur->data[field] = to; - if (to + len > end_to) + if (unlikely(len > (ulong)(end_to-to) || to > end_to)) { free_rows(result); set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate); @@ -1708,7 +1708,7 @@ read_one_row(MYSQL *mysql,uint fields,MYSQL_ROW row, ulong *lengths) } else { - if (pos + len > end_pos) + if (unlikely(len > (ulong)(end_pos - pos) || pos > end_pos)) { set_mysql_error(mysql, CR_UNKNOWN_ERROR, unknown_sqlstate); return -1; -- cgit v1.2.1 From fab383aac0a713b48765d0464428199470ae8c0a Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Mon, 30 Apr 2018 23:06:09 +0200 Subject: Use after free in authentication --- sql-common/client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sql-common/client.c') diff --git a/sql-common/client.c b/sql-common/client.c index b485ebf4f60..00e2877bedb 100644 --- a/sql-common/client.c +++ b/sql-common/client.c @@ -2742,7 +2742,7 @@ static int client_mpvio_read_packet(struct st_plugin_vio *mpv, uchar **buf) *buf= mysql->net.read_pos; /* was it a request to change plugins ? */ - if (**buf == 254) + if (pkt_len == packet_error || **buf == 254) return (int)packet_error; /* if yes, this plugin shan't continue */ /* @@ -2927,7 +2927,7 @@ int run_plugin_auth(MYSQL *mysql, char *data, uint data_len, compile_time_assert(CR_OK == -1); compile_time_assert(CR_ERROR == 0); - if (res > CR_OK && mysql->net.read_pos[0] != 254) + if (res > CR_OK && (mysql->net.last_errno || mysql->net.read_pos[0] != 254)) { /* the plugin returned an error. write it down in mysql, -- cgit v1.2.1 From 1d58d184c2c4ddd8a3b2be6f86d76c4e57bbe14f Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Fri, 4 May 2018 00:09:45 +0200 Subject: protocol: verify that number of rows is correct --- sql-common/client.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) (limited to 'sql-common/client.c') diff --git a/sql-common/client.c b/sql-common/client.c index 00e2877bedb..6321e64bc75 100644 --- a/sql-common/client.c +++ b/sql-common/client.c @@ -1483,7 +1483,9 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields, { uchar *pos; /* fields count may be wrong */ - DBUG_ASSERT((uint) (field - result) < fields); + if (field - result >= fields) + goto err; + cli_fetch_lengths(&lengths[0], row->data, default_value ? 8 : 7); field->catalog= strmake_root(alloc,(char*) row->data[0], lengths[0]); field->db= strmake_root(alloc,(char*) row->data[1], lengths[1]); @@ -1501,12 +1503,7 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields, /* Unpack fixed length parts */ if (lengths[6] != 12) - { - /* malformed packet. signal an error. */ - free_rows(data); /* Free old data */ - set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate); - DBUG_RETURN(0); - } + goto err; pos= (uchar*) row->data[6]; field->charsetnr= uint2korr(pos); @@ -1533,6 +1530,8 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields, /* old protocol, for backward compatibility */ for (row=data->data; row ; row = row->next,field++) { + if (field - result >= fields) + goto err; cli_fetch_lengths(&lengths[0], row->data, default_value ? 6 : 5); field->org_table= field->table= strdup_root(alloc,(char*) row->data[0]); field->name= strdup_root(alloc,(char*) row->data[1]); @@ -1569,8 +1568,17 @@ unpack_fields(MYSQL *mysql, MYSQL_DATA *data,MEM_ROOT *alloc,uint fields, } } #endif /* DELETE_SUPPORT_OF_4_0_PROTOCOL */ + if (field - result < fields) + goto err; free_rows(data); /* Free old data */ DBUG_RETURN(result); + +err: + /* malformed packet. signal an error. */ + free_rows(data); + free_root(alloc, MYF(0)); + set_mysql_error(mysql, CR_MALFORMED_PACKET, unknown_sqlstate); + DBUG_RETURN(0); } /* Read all rows (fields or data) from server */ -- cgit v1.2.1