Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
1.1.14
-
None
-
3.13
Description
While the core issue (CONC-820) was fixed in the underlying driver, we require an additional defensive check in the Python extension layer to mitigate risks when linked against older, unpatched versions of Connector/C.
A malicious or compromised server can manipulate field metadata—specifically inflating the length of a NEWDECIMAL field. If this invalid length is passed unfiltered to the Python C-extension, the alloca() call will attempt to allocate excessive memory on the stack, leading to a stack exhaustion/overflow or stack smashing, crashing the application."
Attachments
Issue Links
- relates to
-
CONC-820 alloca() on invalid metadata from the server
-
- Closed
-
- links to