sprintf overlapping in MYSQL_BIN_LOG::handle_binlog_flush_or_sync_error()
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
MySQL Server |
Unknown
|
Unknown
|
||||
Percona Server moved to https://jira.percona.com/projects/PS | Status tracked in 5.7 | |||||
5.5 |
Invalid
|
Undecided
|
Unassigned | |||
5.6 |
Fix Released
|
High
|
Unassigned | |||
5.7 |
Fix Released
|
High
|
Unassigned |
Bug Description
void MYSQL_BIN_
{
char errmsg[
sprintf(errmsg, "An error occurred during %s stage of the commit. "
if (binlog_
{
sprintf(errmsg, "%s Hence aborting the server.", errmsg);
exec_
}
...
}
"C99 and POSIX.1-2001 specify that the results are undefined if a call to sprintf(), snprintf(), vsprintf(), or vsnprintf() would cause
copying to take place between objects that overlap (e.g., if the target string array and one of the supplied input arguments refer to the same buffer). See NOTES."
This string:
sprintf(errmsg, "%s Hence aborting the server.", errmsg);
leads to undefined behaviour, as a result binlog_error_action test fails.
Suggested fix:
void MYSQL_BIN_
{
char errmsg[
snprintf(errmsg, sizeof(errmsg), "An error occurred during %s stage of the commit. "
if (binlog_
{
char errmsg_
snprintf(
exec_
}
...
}
tags: | added: upstream |
http:// bugs.mysql. com/bug. php?id= 80138