Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
1.1.14
-
None
-
3.13
Description
While the core issue (CONC-820) was fixed in the underlying driver, we require an additional defensive check in the Python extension layer to mitigate risks when linked against older, unpatched versions of Connector/C.
A malicious or compromised server can manipulate field metadata—specifically inflating the length of a NEWDECIMAL field. If this invalid length is passed unfiltered to the Python C-extension, the alloca() call will attempt to allocate excessive memory on the stack, leading to a stack exhaustion/overflow or stack smashing, crashing the application."
Attachments
Issue Links
- relates to
-
CONC-820 alloca() on invalid metadata from the server
-
- In Review
-