← Back to branch summary

~ubuntu-branches/ubuntu/natty/mysql-5.1/natty-proposed

« back to all changes in this revision

Viewing changes to sql/sql_plugin.cc

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2012-02-22 08:30:45 UTC
  • mfrom: (1.4.1)
  • Revision ID: package-import@ubuntu.com-20120222083045-2rd53r4bnyx7qus4
Tags: 5.1.61-0ubuntu0.11.04.1
https://launchpad.net/bugs/937869
* SECURITY UPDATE: Update to 5.1.61 to fix multiple security issues
  (LP: #937869)
  - http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
  - CVE-2011-2262
  - CVE-2012-0075
  - CVE-2012-0112
  - CVE-2012-0113
  - CVE-2012-0114
  - CVE-2012-0115
  - CVE-2012-0116
  - CVE-2012-0117
  - CVE-2012-0118
  - CVE-2012-0119
  - CVE-2012-0120
  - CVE-2012-0484
  - CVE-2012-0485
  - CVE-2012-0486
  - CVE-2012-0487
  - CVE-2012-0488
  - CVE-2012-0489
  - CVE-2012-0490
  - CVE-2012-0491
  - CVE-2012-0492
  - CVE-2012-0493
  - CVE-2012-0494
  - CVE-2012-0495
  - CVE-2012-0496

Show diffs side-by-side

added added

removed removed

Lines of Context:
sql/sql_plugin.cc
1
 
/* Copyright (C) 2005 MySQL AB
 
1
/*
 
2
   Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
2
3
 
3
4
   This program is free software; you can redistribute it and/or modify
4
5
   it under the terms of the GNU General Public License as published by
11
12
 
12
13
   You should have received a copy of the GNU General Public License
13
14
   along with this program; if not, write to the Free Software
14
 
   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
 
15
   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
 
16
*/
15
17
 
16
18
#include "mysql_priv.h"
17
19
#include <my_pthread.h>
231
233
#endif /* EMBEDDED_LIBRARY */
232
234
 
233
235
 
 
236
/**
 
237
   Check if the provided path is valid in the sense that it does cause
 
238
   a relative reference outside the directory.
 
239
 
 
240
   @note Currently, this function only check if there are any
 
241
   characters in FN_DIRSEP in the string, but it might change in the
 
242
   future.
 
243
 
 
244
   @code
 
245
   check_valid_path("../foo.so") -> true
 
246
   check_valid_path("foo.so") -> false
 
247
   @endcode
 
248
 */
 
249
bool check_valid_path(const char *path, size_t len)
 
250
{
 
251
  size_t prefix= my_strcspn(files_charset_info, path, path + len, FN_DIRSEP);
 
252
  return  prefix < len;
 
253
}
 
254
 
 
255
 
234
256
/****************************************************************************
235
257
  Value type thunks, allows the C world to play in the C++ world
236
258
****************************************************************************/
354
376
  struct st_plugin_dl *tmp, plugin_dl;
355
377
  void *sym;
356
378
  DBUG_ENTER("plugin_dl_add");
 
379
  DBUG_PRINT("enter", ("dl->str: '%s', dl->length: %d",
 
380
                       dl->str, (int) dl->length));
357
381
  plugin_dir_len= strlen(opt_plugin_dir);
358
382
  /*
359
383
    Ensure that the dll doesn't have a path.
360
384
    This is done to ensure that only approved libraries from the
361
385
    plugin directory are used (to make this even remotely secure).
362
386
  */
363
 
  if (my_strchr(files_charset_info, dl->str, dl->str + dl->length, FN_LIBCHAR) ||
 
387
  if (check_valid_path(dl->str, dl->length) ||
364
388
      check_string_char_length((LEX_STRING *) dl, "", NAME_CHAR_LEN,
365
389
                               system_charset_info, 1) ||
366
390
      plugin_dir_len + dl->length + 1 >= FN_REFLEN)
473
497
    {
474
498
      free_plugin_mem(&plugin_dl);
475
499
      if (report & REPORT_TO_USER)
476
 
        my_error(ER_OUTOFMEMORY, MYF(0), plugin_dl.dl.length);
 
500
        my_error(ER_OUTOFMEMORY, MYF(0),
 
501
                 static_cast<int>(plugin_dl.dl.length));
477
502
      if (report & REPORT_TO_LOG)
478
 
        sql_print_error(ER(ER_OUTOFMEMORY), plugin_dl.dl.length);
 
503
        sql_print_error(ER(ER_OUTOFMEMORY),
 
504
                        static_cast<int>(plugin_dl.dl.length));
479
505
      DBUG_RETURN(0);
480
506
    }
481
507
    /*
498
524
  {
499
525
    free_plugin_mem(&plugin_dl);
500
526
    if (report & REPORT_TO_USER)
501
 
      my_error(ER_OUTOFMEMORY, MYF(0), plugin_dl.dl.length);
 
527
      my_error(ER_OUTOFMEMORY, MYF(0), static_cast<int>(plugin_dl.dl.length));
502
528
    if (report & REPORT_TO_LOG)
503
 
      sql_print_error(ER(ER_OUTOFMEMORY), plugin_dl.dl.length);
 
529
      sql_print_error(ER(ER_OUTOFMEMORY),
 
530
                      static_cast<int>(plugin_dl.dl.length));
504
531
    DBUG_RETURN(0);
505
532
  }
506
533
  plugin_dl.dl.length= copy_and_convert(plugin_dl.dl.str, plugin_dl.dl.length,
512
539
  {
513
540
    free_plugin_mem(&plugin_dl);
514
541
    if (report & REPORT_TO_USER)
515
 
      my_error(ER_OUTOFMEMORY, MYF(0), sizeof(struct st_plugin_dl));
 
542
      my_error(ER_OUTOFMEMORY, MYF(0),
 
543
               static_cast<int>(sizeof(struct st_plugin_dl)));
516
544
    if (report & REPORT_TO_LOG)
517
 
      sql_print_error(ER(ER_OUTOFMEMORY), sizeof(struct st_plugin_dl));
 
545
      sql_print_error(ER(ER_OUTOFMEMORY),
 
546
                      static_cast<int>(sizeof(struct st_plugin_dl)));
518
547
    DBUG_RETURN(0);
519
548
  }
520
549
  DBUG_RETURN(tmp);