drizzle_state_field_read() can read past packet boundary

Bug #1150811 reported by Wim Lewis
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Drizzle Client & Protocol Library
Fix Released
Medium
Wim Lewis

Bug Description

drizzle_state_field_read() has logic like this in a couple of places:

 [ http://bazaar.launchpad.net/~drizzle-trunk/libdrizzle/libdrizzle-redux/view/99.1.7/libdrizzle/field.cc#L234 ]

    if ((size_t)(con->buffer_size) >= con->result->field_total)
    {
      con->result->field_size= con->result->field_total;
    }
    else
    {
      con->result->field_size= con->buffer_size;
    }

However, if the field is broken across multiple packets, and the buffer contains the rest of this packet and the beginning of the next, this can read too much data into the field (including the packet header of the next packet). The field_size should be set to the smallest size among buffer_size, packet_size, and field_total.

Related branches

Changed in libdrizzle:
status: New → In Progress
importance: Undecided → Medium
assignee: nobody → Wim Lewis (wiml)
Changed in libdrizzle:
status: In Progress → Fix Released
Changed in libdrizzle:
milestone: none → 5.1.4
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.