Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40670

qc_info OOB read if query contains \0

    XMLWordPrintable

Details

    • Unexpected results

    Description

      qc_info plugin (information_schema.query_cache_info) prints query cache entries.

      The format of a query cache key is [query text][\0][db name length][db name][flags] and this, obviously cannot be unambiguously parsed if the query text can contain \0 bytes.

      The plugin assumes that it doesn't and parses under this assumption. With a \0 in a query the plugin can read a very large number for the db name length and show up to 192 following utf8 characters in the statement_schema column.

      This cannot be fixed without changing how query cache key format, which we won't be doing for this plugin. Let's just limit the db name length to never read beyond the db name end.

      Reported by Yuelin Wang

      Attachments

        Issue Links

          Activity

            People

              serg Sergei Golubchik
              serg Sergei Golubchik
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1h
                  1h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.