Skip to content
  • Dmitry Lenev's avatar
    a3de7266
    Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE · a3de7266
    Dmitry Lenev authored
    ROBUST AGAINST BUGS IN CALLERS".
    
    Both MDL subsystems and Table Definition Cache code assume
    that callers ensure that names of objects passed to them are
    not longer than NAME_LEN bytes. Unfortunately due to bugs in
    callers this assumption might be broken in some cases. As
    result we get nasty bugs causing buffer overruns when we
    construct MDL key or TDC key from object names.
    
    This patch makes MDL and TDC code more robust against such
    bugs by ensuring that we always checking size of result
    buffer when constructing MDL and TDC keys. This doesn't
    free its callers from ensuring that both db and table names
    are shorter than NAME_LEN bytes. But at least these steps
    prevents buffer overruns in case of bug in caller, replacing
    them with less harmful behavior.
    
    This is 5.6+ version of patch.
    
    Changed code of MDL_key::mdl_key_init() to take into account
    size of buffer for the key. Did the same thing for
    create_table_def_key() function. Added asserts ensuring that
    callers won't pass arguments longer than NAME_LEN to them.
    
    Adjusted code constructing TDC keys directly to either use
    create_table_def_key() or get_table_def_key(). To support
    this change changed assert in get_table_def_key() in such
    way that it can be for table list elements which were used
    for opening of a view.
    a3de7266
    Bug #15954872 "MAKE MDL SUBSYSTEM AND TABLE DEFINITION CACHE
    Dmitry Lenev authored
    ROBUST AGAINST BUGS IN CALLERS".
    
    Both MDL subsystems and Table Definition Cache code assume
    that callers ensure that names of objects passed to them are
    not longer than NAME_LEN bytes. Unfortunately due to bugs in
    callers this assumption might be broken in some cases. As
    result we get nasty bugs causing buffer overruns when we
    construct MDL key or TDC key from object names.
    
    This patch makes MDL and TDC code more robust against such
    bugs by ensuring that we always checking size of result
    buffer when constructing MDL and TDC keys. This doesn't
    free its callers from ensuring that both db and table names
    are shorter than NAME_LEN bytes. But at least these steps
    prevents buffer overruns in case of bug in caller, replacing
    them with less harmful behavior.
    
    This is 5.6+ version of patch.
    
    Changed code of MDL_key::mdl_key_init() to take into account
    size of buffer for the key. Did the same thing for
    create_table_def_key() function. Added asserts ensuring that
    callers won't pass arguments longer than NAME_LEN to them.
    
    Adjusted code constructing TDC keys directly to either use
    create_table_def_key() or get_table_def_key(). To support
    this change changed assert in get_table_def_key() in such
    way that it can be for table list elements which were used
    for opening of a view.
Loading