• Dmitry Lenev's avatar
    Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE · 2e10e7c3
    Dmitry Lenev authored
    ROBUST AGAINST BUGS IN CALLERS".
    
    Both MDL subsystems and Table Definition Cache code assume 
    that callers ensure that names of objects passed to them are 
    not longer than NAME_LEN bytes. Unfortunately due to bugs in 
    callers this assumption might be broken in some cases. As
    result we get nasty bugs causing buffer overruns when we
    construct MDL key or TDC key from object names.
    
    This patch makes TDC code more robust against such bugs by 
    ensuring that we always checking size of result buffer when
    constructing TDC keys. This doesn't free its callers from 
    ensuring that both db and table names are shorter than 
    NAME_LEN bytes. But at least this steps prevents buffer 
    overruns in case of bug in caller, replacing them with less 
    harmful behavior.
    
    This is 5.1-only version of patch.
    
    This patch introduces new version of create_table_def_key()
    helper function which constructs TDC key without risk of
    result buffer overrun. Places in code that construct TDC keys 
    were changed to use this function.
    
    Also changed rm_temporary_table() and open_new_frm() functions
    to avoid use of "unsafe" strmov() and strxmov() functions and 
    use safer strnxmov() instead.
    2e10e7c3
sql_trigger.cc 72.9 KB