From: Date: June 12 2007 2:47pm
Subject: bk commit into 4.1 tree (cmiller:1.2666) BUG#28984
List-Archive: http://lists.mysql.com/commits/28573
X-Bug: 28984
Message-Id: <20070612124739.344A18304C@zippy>

Below is the list of changes that have just been committed into a local
4.1 repository of cmiller. When cmiller does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet@stripped, 2007-06-12 08:47:36-04:00, cmiller@stripped +1 -0
  Bug#28984: crasher on connect with out of range password length in \
  	protocol
  
  Fixed duplicated code, same as last commit.
  
  One could send a malformed packet that caused the server to SEGV.  In 
  recent versions of the password protocol, the client tells the server 
  what length the ciphertext is (almost always 20).  If that length was
  large enough to overflow a signed char, then the number would jump to 
  very large after being casted to unsigned int.
  
  Instead, cast the *passwd char to uchar.

  sql/sql_parse.cc@stripped, 2007-06-12 08:47:34-04:00, cmiller@stripped +4 -1
    Additional location of signed-char casted to uint.

# This is a BitKeeper patch.  What follows are the unified diffs for the
# set of deltas contained in the patch.  The rest of the patch, the part
# that BitKeeper cares about, is below these diffs.
# User:	cmiller
# Host:	zippy.cornsilk.net
# Root:	/home/cmiller/work/mysql/mysql-4.1-maint

--- 1.498/sql/sql_parse.cc	2007-06-08 16:10:51 -04:00
+++ 1.499/sql/sql_parse.cc	2007-06-12 08:47:34 -04:00
@@ -1445,11 +1445,14 @@ bool dispatch_command(enum enum_server_c
       Old clients send null-terminated string ('\0' for empty string) for
       password.  New clients send the size (1 byte) + string (not null
       terminated, so also '\0' for empty string).
+
+      Cast *passwd to an unsigned char, so that it doesn't extend the sign
+      for *passwd > 127 and become 2**32-127 after casting to uint.
     */
     char db_buff[NAME_LEN+1];                 // buffer to store db in utf8 
     char *db= passwd;
     uint passwd_len= thd->client_capabilities & CLIENT_SECURE_CONNECTION ? 
-      *passwd++ : strlen(passwd);
+      (uchar)(*passwd++) : strlen(passwd);
     db+= passwd_len + 1;
 #ifndef EMBEDDED_LIBRARY
     /* Small check for incomming packet */