Details
-
Bug
-
Status: In Review (View Workflow)
-
Blocker
-
Resolution: Unresolved
-
10.5, 10.6, 10.11, 11.4
Description
Currently, the length of the server_audit_file_path system variable value is
not checked. This can cause a buffer overflow if given a long file path
specifying a directory as a memcpy() is performed to copy the entire file path into a
fixed size buffer, char alt_path_buffer[FN_REFLEN+1+DEFAULT_FILENAME_LEN];
Pull request: https://github.com/MariaDB/server/pull/3874