Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40670

qc_info OOB read if query contains \0

    XMLWordPrintable

Details

    • Unexpected results

    Description

      qc_info plugin (information_schema.query_cache_info) prints query cache entries.

      The format of a query cache key is [query text][\0][db name length][db name][flags] and this, obviously cannot be unambiguously parsed if the query text can contain \0 bytes.

      The plugin assumes that it doesn't and parses under this assumption. With a \0 in a query the plugin can read a very large number for the db name length and show up to 192 following utf8 characters in the statement_schema column.

      This cannot be fixed without changing how query cache key format, which we won't be doing for this plugin. Let's just limit the db name length to never read beyond the db name end.

      Reported by Yuelin Wang

      Attachments

        Activity

          People

            serg Sergei Golubchik
            serg Sergei Golubchik
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 1h
                1h

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.