Uploaded image for project: 'MariaDB Connector/C'
  1. MariaDB Connector/C
  2. CONC-820

alloca() on invalid metadata from the server

    XMLWordPrintable

Details

    Description

      ma_stmt_codec.c

      675
            my_bool zf_truncated= 0;
      676
       
      677
            buffer= alloca(MAX(field->length, 22));
      678
            endptr= ma_ll2str(val, buffer, is_unsigned ? 10 : -10);
      679
            len= (uint)(endptr - buffer);
      

      field->length can be very large and alloca() will destroy the stack.

      Reported by Yalguun Tumenkhuu

      Attachments

        Issue Links

          Activity

            People

              georg Georg Richter
              serg Sergei Golubchik
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1h
                  1h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.