hcq/MaxScale
hcq/MaxScale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix buffer overrun on non-terminated comment

Browse Source 
Also made the behavior consistent when an incomplete comment is found.
This commit is contained in:
Markus Mäkelä 2019-01-18 09:58:55 +02:00 committed by Johan Wikman
parent 7f978f275f
commit 9542641dae
3 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
server/core/modutil.cc
View File

@ -1466,7 +1466,11 @@ std::string get_canonical(GWBUF* querybuf)
else if (*it == '/' && is_next(it, buf.end(), "/*"))
{
auto comment_start = std::next(it, 2);
if (comment_start != buf.end() && *comment_start != '!' && *comment_start != 'M')
if (comment_start == buf.end())
{
break;
}
else if (*comment_start != '!' && *comment_start != 'M')
{
// Non-executable comment
while (it != buf.end())
@ -1479,6 +1483,11 @@ std::string get_canonical(GWBUF* querybuf)
}
++it;
}
if (it == buf.end())
{
break;
}
}
else
{
@ -1507,6 +1516,7 @@ std::string get_canonical(GWBUF* querybuf)
++it;
}
if (it == buf.end())
{
break;
@ -1545,6 +1555,8 @@ std::string get_canonical(GWBUF* querybuf)
{
rval[i++] = *it;
}
mxb_assert(it != buf.end());
}
// Shrink the buffer so that the internal bookkeeping of std::string remains up to date

4
server/core/test/canonical_tests/comment.expected
View File

@ -9,3 +9,7 @@ SELECT ? /*! +? */;
SELECT ? /*!? +? */;
SELECT ? /*M! +? */;
SELECT ? /*M!? +? */;
SELECT ?
SELECT ?
SELECT ?
SELECT ?

4
server/core/test/canonical_tests/comment.sql
View File

@ -9,3 +9,7 @@ SELECT 1 /*! +1 */;
SELECT 1 /*!50101 +1 */;
SELECT 2 /*M! +1 */;
SELECT 2 /*M!50101 +1 */;
SELECT 2 /*
SELECT 2 /*
SELECT 2 /*/
SELECT 2 /**/