1. 09 Nov, 2007 1 commit
    • mats@capulet.net's avatar
      BUG#31793 (log event corruption causes crash): · a432d3de
      mats@capulet.net authored
      When running mysqlbinlog on a 64-bit machine with a corrupt relay log,
      it causes mysqlbinlog to crash. In this case, the crash is caused
      because a request for 18446744073709534806U bytes is issued, which
      apparantly can be served on a 64-bit machine (speculatively, I assume)
      but this causes the memcpy() issued later to copy the data to segfault.
      
      The request for the number of bytes is caused by a computation
      of data_len - server_vars_len where server_vars_len is corrupt in such
      a sense that it is > data_len. This causes a wrap-around, with the
      the data_len given above.
      
      This patch adds a check that if server_vars_len is greater than
      data_len before the substraction, and aborts reading the event in
      that case marking the event as invalid. It also adds checks to see
      that reading the server variables does not go outside the bounds
      of the available space, giving a limited amount of integrity check.
      a432d3de
  2. 31 Oct, 2007 1 commit
  3. 30 Oct, 2007 1 commit
  4. 26 Oct, 2007 2 commits
  5. 24 Oct, 2007 3 commits
  6. 23 Oct, 2007 15 commits
  7. 22 Oct, 2007 4 commits
  8. 21 Oct, 2007 5 commits
  9. 19 Oct, 2007 3 commits
  10. 18 Oct, 2007 5 commits