• Arun Kuruvila's avatar
    Bug #20605441 : BUFFER OVERFLOW IN MYSQLSLAP · 044e3b1d
    Arun Kuruvila authored
    Description:- mysqlslap is a diagnostic utility designed to
    emulate client load for a MySQL server and to report the
    timing of each stage. This utility crashes when invalid
    values are passed to the options 'num_int_cols_opt' or
    'num_chars_cols_opt' or 'engine'.
    
    Analysis:- mysqlslap uses "parse_option()" to parse the
    values specified to the options 'num_int_cols_opt',
    'num_chars_cols_opt' and 'engine'. These options takes
    values separated by commas. In "parse_option()", the comma
    separated values are separated and copied into a buffer
    without checking the length of the string to be copied. The
    size of the buffer is defined by a macro HUGE_STRING_LENGTH
    whose value is 8196. So if the length of the any of the
    comma separated value exceeds HUGE_STRING_LENGTH, will
    result in a buffer overflow.
    
    Fix:- A check is introduced in "parse_option()" to check
    whether the size of the string to be copied is more than
    HUGE_STRING_LENGTH. If it is more, an error, "Invalid value
    specified for the option 'xxx'" is thrown.
    Option length was incorrectly calculated for the last comma
    separated value. So fixed that as well.
    044e3b1d
mysqlslap.c 64.1 KB