2012-09-05 16:30:05.541405+00:00
https://api.launchpad.net/1.0/bugs/802400
https://api.launchpad.net/1.0/~dveeden
https://api.launchpad.net/1.0/maria/+milestone/5.1
https://api.launchpad.net/1.0/bugs/802400/linked_branches
https://api.launchpad.net/1.0/bugs/802400/activity
https://bugs.launchpad.net/bugs/802400
Daniël van Eeden
Maria 5.1
mysql help sends unchecked contents to mysqld
Confirmed
Medium
2011-06-27 08:49:09.620809+00:00
create table t1 (`id` int(11) auto_increment, `name` varchar(255), primary key (`id`));
Query OK, 0 rows affected (0.00 sec)
mysql> INSERT INTO t1(`name`) VALUES ('test1'),('test2'),('test3'),('test4');
Query OK, 4 rows affected (0.00 sec)
Records: 4 Duplicates: 0 Warnings: 0
mysql> SELECT * FORM t1;
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FORM t1' at line 1
mysql> SELECT * FROM t1;
+----+-------+
| id | name |
+----+-------+
| 1 | test1 |
| 2 | test2 |
| 3 | test3 |
| 4 | test4 |
+----+-------+
4 rows in set (0.00 sec)
mysql> DELETE FROM t1 LIMIT 1;
Query OK, 1 row affected (0.00 sec)
mysql> help 'contents'
mysql> SELECT * FROM t1;
+----+-------+
| id | name |
+----+-------+
| 3 | test3 |
| 4 | test4 |
+----+-------+
2 rows in set (0.00 sec)
mysql> \q
Bye
================================================
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 2
Server version: 5.2.7-MariaDB (MariaDB - http://mariadb.com/)
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL v2 license
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> help 'contents'
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Your MariaDB connection id is 2
Server version: 5.2.7-MariaDB (MariaDB - http://' at line 1]]>
bug
Daniël van Eeden
added bug
bug task added
Daniël van Eeden
bug
Daniël van Eeden
added subscriber Percona developers
bug watch added
Daniël van Eeden
bug task added
Daniël van Eeden
bug watch added
Daniël van Eeden
bug task added
Daniël van Eeden
bug task added
Daniël van Eeden
maria: milestone
Sergei
maria: status
Sergei
maria: importance
Sergei
visibility
Sergei
security vulnerability
Sergei
mysql-5.1 (Ubuntu): importance
Chuck Short
mysql-5.1 (Ubuntu): status
Chuck Short
percona-server: importance
Stewart Smith
percona-server: assignee
Patrick Crews
percona-server: assignee
Laurynas Biveinis
percona-server: status
Raghavendra D Prabhu
Daniël van Eeden
Sergei
Chuck Short
Raghavendra D Prabhu
ptr();
char cmd_buf[100 + 1];
MYSQL_RES *result;
int error;
if (help_arg[0] != '\'')
{
char *end_arg= strend(help_arg);
if(--end_arg)
{
while (my_isspace(charset_info,*end_arg))
end_arg--;
*++end_arg= '\0';
}
(void) strxnmov(cmd_buf, sizeof(cmd_buf), "help '", help_arg, "'", NullS);
server_cmd= cmd_buf;
}
if (!status.batch)
{
old_buffer= *buffer;
old_buffer.copy();
}
======
As you can see it explicitly checks for single quote and does some string filtering to finally append " help ' " and " ' " to it if does not have them already.
The problem lies here --
const char *server_cmd= buffer->ptr()
If the string already starts with single quote, server_cmd ends up with value of glob_buffer like this:
print server_cmd
$10 = 0x98d660 "Your MySQL connection id is 11\nServer version: 5.5.27-rel28.0-debug-log Built by raghavendra at Tue Aug 21 00:41:10 IST 2012\n"
and rest follows.
Interesting to observe that the argument has been marked __attribute__((unused)) but is still used.
This section
===
if (!status.batch)
{
old_buffer= *buffer;
old_buffer.copy();
}
======
is also suspicious (because of unused attribute) but *not* directly relevant to this bug. (For curious, old_buffer is used in com_edit when \e is invoked, however, after the fix(below) I checked and \e along with \h was working fine: something like
> select \h help 'contents' \e will copy select to $EDITOR's buffer
Anyways, here is the fix:
=== modified file 'Percona-Server/client/mysql.cc'
--- Percona-Server/client/mysql.cc 2012-08-07 06:10:00 +0000
+++ Percona-Server/client/mysql.cc 2012-09-05 16:14:14 +0000
@@ -2827,7 +2827,7 @@
char *line __attribute__((unused)), char *help_arg)
{
MYSQL_ROW cur;
- const char *server_cmd= buffer->ptr();
+ const char *server_cmd= help_arg;
char cmd_buf[100 + 1];
MYSQL_RES *result;
int error;
@@ -2842,8 +2842,10 @@
*++end_arg= '\0';
}
(void) strxnmov(cmd_buf, sizeof(cmd_buf), "help '", help_arg, "'", NullS);
- server_cmd= cmd_buf;
+ } else {
+ (void) strxnmov(cmd_buf, sizeof(cmd_buf), "help ", help_arg, NullS);
}
+ server_cmd= cmd_buf;
After the fix:
>>./client/mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 19
Server version: 5.5.27-log Source distribution
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> help contents
You asked for help about help category: "Contents"
For more information, type 'help - ', where
- is one of the following
categories:
Account Management
Administration
Compound Statements
Data Definition
Data Manipulation
Data Types
Functions
Functions and Modifiers for Use with GROUP BY
Geographic Features
Help Metadata
Language Structure
Plugins
Procedures
Table Maintenance
Transactions
User-Defined Functions
Utility
mysql> help 'contents'
You asked for help about help category: "Contents"
For more information, type 'help
- ', where
- is one of the following
categories:
Account Management
Administration
Compound Statements
Data Definition
Data Manipulation
Data Types
Functions
Functions and Modifiers for Use with GROUP BY
Geographic Features
Help Metadata
Language Structure
Plugins
Procedures
Table Maintenance
Transactions
User-Defined Functions
Utility
Also, with the test case:
=============================
./client/mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 20
Server version: 5.5.27-log Source distribution
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> create table t1 (`id` int(11) auto_increment, `name` varchar(255), primary key (`id`));
ERROR 1046 (3D000): No database selected
mysql> use test;
Database changed
mysql> drop table t1;
Query OK, 0 rows affected (0.01 sec)
mysql> create table t1 (`id` int(11) auto_increment, `name` varchar(255), primary key (`id`));
Query OK, 0 rows affected (0.00 sec)
mysql> INSERT INTO t1(`name`) VALUES ('test1'),('test2'),('test3'),('test4');
Query OK, 4 rows affected (0.00 sec)
Records: 4 Duplicates: 0 Warnings: 0
mysql> SELECT * FROM t1;
+----+-------+
| id | name |
+----+-------+
| 1 | test1 |
| 2 | test2 |
| 3 | test3 |
| 4 | test4 |
+----+-------+
4 rows in set (0.00 sec)
mysql> DELETE FROM t1 LIMIT 1;
Query OK, 1 row affected (0.00 sec)
mysql> help 'contents'
You asked for help about help category: "Contents"
For more information, type 'help
- ', where
- is one of the following
categories:
Account Management
Administration
Compound Statements
Data Definition
Data Manipulation
Data Types
Functions
Functions and Modifiers for Use with GROUP BY
Geographic Features
Help Metadata
Language Structure
Plugins
Procedures
Table Maintenance
Transactions
User-Defined Functions
Utility
mysql> SELECT * FROM t1;
+----+-------+
| id | name |
+----+-------+
| 2 | test2 |
| 3 | test3 |
| 4 | test4 |
+----+-------+
3 rows in set (0.00 sec)
mysql> \q
Bye
(origin/Percona-Server)~21:51-0
>>./client/mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 21
Server version: 5.5.27-log Source distribution
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> help 'contents'
You asked for help about help category: "Contents"
For more information, type 'help
- ', where
- is one of the following
categories:
Account Management
Administration
Compound Statements
Data Definition
Data Manipulation
Data Types
Functions
Functions and Modifiers for Use with GROUP BY
Geographic Features
Help Metadata
Language Structure
Plugins
Procedures
Table Maintenance
Transactions
User-Defined Functions
Utility
mysql>
mysql>
mysql>
mysql> help contents
You asked for help about help category: "Contents"
For more information, type 'help
- ', where
- is one of the following
categories:
Account Management
Administration
Compound Statements
Data Definition
Data Manipulation
Data Types
Functions
Functions and Modifiers for Use with GROUP BY
Geographic Features
Help Metadata
Language Structure
Plugins
Procedures
Table Maintenance
Transactions
User-Defined Functions
Utility
mysql>
===============================================================
Lastly, even without the patch, calling help 'contents' didn't eat up any additional rows as in the description (2 rows are deleted instead of 1).]]>
Raghavendra D Prabhu
}
For some reason, str_length shows up as zero. However, I think it is something to do with String class used sql_string.h. Anyways, even in normal cases, it is like that, shouldn't be related to this.]]>