• Lawrin Novitsky's avatar
    MDEV-19838 Wrong direxec param data caused crash · 4b854d47
    Lawrin Novitsky authored
    In case of direct execution(stmtid=-1, mariadb_stmt_execute_direct in C
    API) application is in control of how many parameters client sends to
    the server. In case this number is not equal to actual query parameters
    number, the server may start to interprete packet data incorrectly, e.g.
    starting from the size of null bitmap. And that could cause it to crash
    at some point. The commit introduces some additional COM_STMT_EXECUTE
    packet sanity checks:
    - checking that "types sent" byte is set, and the value is equal to 1.
      if it's not direct execution, then that value is 0 or 1.
    - checking that parameter type value is a valid type, and parameter
      flags value is 0 or only "unsigned" bit is set
    - added more checks that read does not go beyond the end of the packet
    4b854d47
mysql_client_test.c 542 KB