Details
-
Bug
-
Status: Closed (View Workflow)
-
Blocker
-
Resolution: Fixed
-
10.6(EOL), 10.11, 11.4, 11.8, 12.3
-
Can result in hang or crash
-
Q3/2026 Server Maintenance
Description
For example, in mariadb-dump has
|
mysqldump.c |
|
1605
|
char quoted_db_buf[NAME_LEN * 2 + 3]; |
1606
|
char *quoted_db_name= quote_name(db_name, quoted_db_buf, FALSE); |
where db_name comes from SHOW DATABASES and is assumed to be no longer than {{NAME_LEN}, but there's no check for that.
If a newer server will use a larger identifier length or someone will hack the server to send longer names, a client will likely crash.
It's in many places in different clients:
| Tool | Function / Line | Buffer |
|---|---|---|
| mariadb-dump | quote_name() :2227 | table_buff[NAME_LEN*2+3] |
| mariadb-dump | quote_for_like() :2269 | show_name_buff[NAME_LEN*2+2+24] |
| mariadb-dump | strmov() :5862 | hash_key[2*NAME_LEN+2] |
| mysqladmin | strmov() :1501 | pidfile[FN_REFLEN] |
| mysqlcheck | strmov() :1108 | prev[(NAME_LEN+9)*3+2] |
| mariadb-dump | strxmov() :5493 | buf[FN_REFLEN] |
| mariadb-dump | strxmov() :7161 | search_buf[256] / replace_buf[256] |
| mariadb-dump | quote_for_equal() :4965 | buf[200] |
Reported by Psalms Christopher Matovu (ByteOverride)
