mariadb/mariadb-covscan-stroverflow.patch

57 lines
2.9 KiB
Diff
Raw Normal View History

The following problems have been found by Coverity - static analysis tool.
mysql-5.5.31/plugin/semisync/semisync_master.cc:672:parameter_as_source Note: This defect has an elevated risk because the source argument is a parameter of the current function.
mysql-5.5.31/plugin/semisync/semisync_master.cc:661:parameter_as_source Note: This defect has an elevated risk because the source argument is a parameter of the current function.
mysql-5.5.31/plugin/semisync/semisync_master.cc:555:parameter_as_source Note: This defect has an elevated risk because the source argument is a parameter of the current function.
2014-04-07 19:07:33 +00:00
diff -up mariadb-10.0.10/plugin/semisync/semisync_master.cc.p12 mariadb-10.0.10/plugin/semisync/semisync_master.cc
--- mariadb-10.0.10/plugin/semisync/semisync_master.cc.p12 2014-03-30 19:56:37.000000000 +0200
+++ mariadb-10.0.10/plugin/semisync/semisync_master.cc 2014-04-07 20:02:49.614944992 +0200
@@ -553,7 +553,8 @@ int ReplSemiSyncMaster::reportReplyBinlo
if (need_copy_send_pos)
{
- strcpy(reply_file_name_, log_file_name);
+ strncpy(reply_file_name_, log_file_name, sizeof(reply_file_name_)-1);
+ reply_file_name_[sizeof(reply_file_name_)-1] = '\0';
reply_file_pos_ = log_file_pos;
reply_file_name_inited_ = true;
2014-04-07 19:07:33 +00:00
@@ -661,7 +662,8 @@ int ReplSemiSyncMaster::commitTrx(const
if (cmp <= 0)
{
/* This thd has a lower position, let's update the minimum info. */
- strcpy(wait_file_name_, trx_wait_binlog_name);
+ strncpy(wait_file_name_, trx_wait_binlog_name, sizeof(wait_file_name_)-1);
+ wait_file_name_[sizeof(wait_file_name_)-1] = '\0';
wait_file_pos_ = trx_wait_binlog_pos;
rpl_semi_sync_master_wait_pos_backtraverse++;
2014-04-07 19:07:33 +00:00
@@ -672,7 +674,8 @@ int ReplSemiSyncMaster::commitTrx(const
}
else
{
- strcpy(wait_file_name_, trx_wait_binlog_name);
+ strncpy(wait_file_name_, trx_wait_binlog_name, sizeof(wait_file_name_)-1);
+ wait_file_name_[sizeof(wait_file_name_)-1] = '\0';
wait_file_pos_ = trx_wait_binlog_pos;
wait_file_name_inited_ = true;
mysql-5.5.31/sql/rpl_handler.cc:306:fixed_size_dest You might overrun the 512 byte fixed-size string "log_info->log_file" by copying "log_file + dirname_length(log_file)" without checking the length. diff -up mysql-5.5.31/sql/rpl_handler.cc.covscan-stroverflow mysql-5.5.31/sql/rpl_handler.cc
2014-04-07 19:07:33 +00:00
--- mariadb-10.0.10/sql/rpl_handler.cc.p12 2014-03-30 19:56:34.000000000 +0200
+++ mariadb-10.0.10/sql/rpl_handler.cc 2014-04-07 20:07:58.851123497 +0200
@@ -303,7 +303,8 @@ int Binlog_storage_delegate::after_flush
my_pthread_setspecific_ptr(RPL_TRANS_BINLOG_INFO, log_info);
}
- strcpy(log_info->log_file, log_file+dirname_length(log_file));
+ strncpy(log_info->log_file, log_file+dirname_length(log_file), sizeof(log_info->log_file)-1);
+ log_info->log_file[sizeof(log_info->log_file)-1] = '\0';
log_info->log_pos = log_pos;
int ret= 0;