Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-39564

One-byte OOB write in PROXY protocol v1 header parser

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      When the client sends a PROXY-protocol v1 signature followed by 252 bytes that contain no \n terminator, parse_proxy_protocol_header exits its read loop with pos == sizeof(hdr) and then executes hdr[pos] = 0, writing one byte past the end of the buffer.

      Reported by Sean Nejad.

      Attachments

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. MDEV-39219 Buffer overflow in PROXY protocol header v1 parsing

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-39464 Fix off-by-one stack buffer overflow in PROXY v1 head

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            People

              serg Sergei Golubchik
              serg Sergei Golubchik
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1h
                  1h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.