hcq/MaxScale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix possible buffer overrun in readwritesplit

Browse Source 
If the GWBUF length was larger than the stack buffer length, the code
would write past the buffer.
This commit is contained in:
Markus Mäkelä
2018-09-12 10:26:57 +03:00
parent f6840fbded
commit 96a78685bc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
server/modules/routing/readwritesplit/rwsplit_session_cmd.cc
View File

@ -35,7 +35,7 @@ static std::string extract_error(GWBUF* buffer)
{ {
size_t replylen = MYSQL_GET_PAYLOAD_LEN(GWBUF_DATA(buffer)); size_t replylen = MYSQL_GET_PAYLOAD_LEN(GWBUF_DATA(buffer));
char replybuf[replylen]; char replybuf[replylen];
gwbuf_copy_data(buffer, 0, gwbuf_length(buffer), (uint8_t*)replybuf); gwbuf_copy_data(buffer, 0, sizeof(replybuf), (uint8_t*)replybuf);
std::string err; std::string err;
std::string msg; std::string msg;
err.append(replybuf + 8, 5); err.append(replybuf + 8, 5);