173 lines
6.4 KiB
Diff
173 lines
6.4 KiB
Diff
From 2759b87d72926b7c9b5426437a7c8dd15ff57945 Mon Sep 17 00:00:00 2001
|
|
From: Sergei Golubchik <serg@mariadb.org>
|
|
Date: Thu, 7 May 2020 14:57:00 +0200
|
|
Subject: [PATCH] sanity checks for client-supplied OK packet content
|
|
reason: Fix CVE-2020-13249
|
|
|
|
Conflict:NA
|
|
Reference:https://github.com/mariadb-corporation/mariadb-connector-c/commit/2759b87d72926b7c9b5426437a7c8dd15ff57945
|
|
|
|
reported by Matthias Kaiser, Apple Information Security
|
|
Signed-off-by: Sergei Golubchik <serg@mariadb.org>
|
|
---
|
|
libmariadb/mariadb_lib.c | 55 +++++++++++++++++++++++++++-------------
|
|
1 file changed, 37 insertions(+), 18 deletions(-)
|
|
|
|
diff --git a/libmariadb/mariadb_lib.c b/libmariadb/mariadb_lib.c
|
|
index b7316b2..877c216 100644
|
|
--- a/libmariadb/mariadb_lib.c
|
|
+++ b/libmariadb/mariadb_lib.c
|
|
@@ -75,6 +75,8 @@
|
|
#define ASYNC_CONTEXT_DEFAULT_STACK_SIZE (4096*15)
|
|
#define MA_RPL_VERSION_HACK "5.5.5-"
|
|
|
|
+#define CHARSET_NAME_LEN 64
|
|
+
|
|
#undef max_allowed_packet
|
|
#undef net_buffer_length
|
|
extern ulong max_allowed_packet; /* net.c */
|
|
@@ -1979,6 +1981,7 @@ mysql_send_query(MYSQL* mysql, const char* query, unsigned long length)
|
|
|
|
int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
|
|
{
|
|
+ uchar *end= mysql->net.read_pos+length;
|
|
size_t item_len;
|
|
mysql->affected_rows= net_field_length_ll(&pos);
|
|
mysql->insert_id= net_field_length_ll(&pos);
|
|
@@ -1986,10 +1989,14 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
|
|
pos+=2;
|
|
mysql->warning_count=uint2korr(pos);
|
|
pos+=2;
|
|
- if (pos < mysql->net.read_pos+length)
|
|
+ if (pos > end)
|
|
+ goto corrupted;
|
|
+ if (pos < end)
|
|
{
|
|
if ((item_len= net_field_length(&pos)))
|
|
mysql->info=(char*) pos;
|
|
+ if (pos + item_len > end)
|
|
+ goto corrupted;
|
|
|
|
/* check if server supports session tracking */
|
|
if (mysql->server_capabilities & CLIENT_SESSION_TRACKING)
|
|
@@ -2000,23 +2007,26 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
|
|
if (mysql->server_status & SERVER_SESSION_STATE_CHANGED)
|
|
{
|
|
int i;
|
|
- if (pos < mysql->net.read_pos + length)
|
|
+ if (pos < end)
|
|
{
|
|
LIST *session_item;
|
|
MYSQL_LEX_STRING *str= NULL;
|
|
enum enum_session_state_type si_type;
|
|
uchar *old_pos= pos;
|
|
- size_t item_len= net_field_length(&pos); /* length for all items */
|
|
+
|
|
+ item_len= net_field_length(&pos); /* length for all items */
|
|
+ if (pos + item_len > end)
|
|
+ goto corrupted;
|
|
+ end= pos + item_len;
|
|
|
|
/* length was already set, so make sure that info will be zero terminated */
|
|
if (mysql->info)
|
|
*old_pos= 0;
|
|
|
|
- while (item_len > 0)
|
|
+ while (pos < end)
|
|
{
|
|
size_t plen;
|
|
char *data;
|
|
- old_pos= pos;
|
|
si_type= (enum enum_session_state_type)net_field_length(&pos);
|
|
switch(si_type) {
|
|
case SESSION_TRACK_SCHEMA:
|
|
@@ -2025,15 +2035,14 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
|
|
case SESSION_TRACK_SYSTEM_VARIABLES:
|
|
net_field_length(&pos); /* ignore total length, item length will follow next */
|
|
plen= net_field_length(&pos);
|
|
+ if (pos + plen > end)
|
|
+ goto corrupted;
|
|
if (!ma_multi_malloc(0,
|
|
&session_item, sizeof(LIST),
|
|
&str, sizeof(MYSQL_LEX_STRING),
|
|
&data, plen,
|
|
NULL))
|
|
- {
|
|
- SET_CLIENT_ERROR(mysql, CR_OUT_OF_MEMORY, SQLSTATE_UNKNOWN, 0);
|
|
- return -1;
|
|
- }
|
|
+ goto oom;
|
|
str->length= plen;
|
|
str->str= data;
|
|
memcpy(str->str, (char *)pos, plen);
|
|
@@ -2056,29 +2065,28 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
|
|
if (!strncmp(str->str, "character_set_client", str->length))
|
|
set_charset= 1;
|
|
plen= net_field_length(&pos);
|
|
+ if (pos + plen > end)
|
|
+ goto corrupted;
|
|
if (!ma_multi_malloc(0,
|
|
&session_item, sizeof(LIST),
|
|
&str, sizeof(MYSQL_LEX_STRING),
|
|
&data, plen,
|
|
NULL))
|
|
- {
|
|
- SET_CLIENT_ERROR(mysql, CR_OUT_OF_MEMORY, SQLSTATE_UNKNOWN, 0);
|
|
- return -1;
|
|
- }
|
|
+ goto oom;
|
|
str->length= plen;
|
|
str->str= data;
|
|
memcpy(str->str, (char *)pos, plen);
|
|
pos+= plen;
|
|
session_item->data= str;
|
|
mysql->extension->session_state[si_type].list= list_add(mysql->extension->session_state[si_type].list, session_item);
|
|
- if (set_charset &&
|
|
+ if (set_charset && str->length < CHARSET_NAME_LEN &&
|
|
strncmp(mysql->charset->csname, str->str, str->length) != 0)
|
|
{
|
|
- char cs_name[64];
|
|
- MARIADB_CHARSET_INFO *cs_info;
|
|
+ char cs_name[CHARSET_NAME_LEN];
|
|
+ const MARIADB_CHARSET_INFO *cs_info;
|
|
memcpy(cs_name, str->str, str->length);
|
|
cs_name[str->length]= 0;
|
|
- if ((cs_info = (MARIADB_CHARSET_INFO *)mysql_find_charset_name(cs_name)))
|
|
+ if ((cs_info = mysql_find_charset_name(cs_name)))
|
|
mysql->charset= cs_info;
|
|
}
|
|
}
|
|
@@ -2086,10 +2094,11 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
|
|
default:
|
|
/* not supported yet */
|
|
plen= net_field_length(&pos);
|
|
+ if (pos + plen > end)
|
|
+ goto corrupted;
|
|
pos+= plen;
|
|
break;
|
|
}
|
|
- item_len-= (pos - old_pos);
|
|
}
|
|
}
|
|
for (i= SESSION_TRACK_BEGIN; i <= SESSION_TRACK_END; i++)
|
|
@@ -2101,6 +2110,16 @@ int ma_read_ok_packet(MYSQL *mysql, uchar *pos, ulong length)
|
|
}
|
|
}
|
|
return(0);
|
|
+
|
|
+oom:
|
|
+ ma_clear_session_state(mysql);
|
|
+ SET_CLIENT_ERROR(mysql, CR_OUT_OF_MEMORY, SQLSTATE_UNKNOWN, 0);
|
|
+ return -1;
|
|
+
|
|
+corrupted:
|
|
+ ma_clear_session_state(mysql);
|
|
+ SET_CLIENT_ERROR(mysql, CR_MALFORMED_PACKET, SQLSTATE_UNKNOWN, 0);
|
|
+ return -1;
|
|
}
|
|
|
|
int mthd_my_read_query_result(MYSQL *mysql)
|
|
--
|
|
2.23.0
|
|
|