bk commit into 4.1 tree (tnurnberg:1.2686) BUG#31588

[Tatjana A Nuernberg]

Below is the list of changes that have just been committed into a local
4.1 repository of tnurnberg. When tnurnberg does a push these changes will
be propagated to the main repository and, within 24 hours after the
push, to the public repository.
For information on how to access the public repository
see http://dev.mysql.com/doc/mysql/en/installing-source-tree.html

ChangeSet@stripped, 2007-10-18 10:47:54+02:00, tnurnberg@stripped +3 -0
  Bug#31588: buffer overrun when setting variables
  
  Buffer used when setting variables was not dimensioned to accomodate
  trailing '\0'. An overflow by one character was therefore possible.
  CS corrects limits to prevent such overflows.

  mysql-test/r/variables.result@stripped, 2007-10-18 10:47:51+02:00,
tnurnberg@stripped +3 -0
    Try to overflow buffer used for setting system variables.
    Unpatched server should throw a valgrind warning here.
    Actual value and error message irrelevant, only length counts.

  mysql-test/t/variables.test@stripped, 2007-10-18 10:47:52+02:00,
tnurnberg@stripped +8 -1
    Try to overflow buffer used for setting system variables.

  sql/set_var.cc@stripped, 2007-10-18 10:47:52+02:00, tnurnberg@stripped +1 -1
    Adjust maximum number of characters we can store in 'buff' by one
    as strmake() will write a terminating '\0'.

diff -Nrup a/mysql-test/r/variables.result b/mysql-test/r/variables.result
--- a/mysql-test/r/variables.result	2006-12-05 10:45:16 +01:00
+++ b/mysql-test/r/variables.result	2007-10-18 10:47:51 +02:00
@@ -561,3 +561,6 @@ set @@query_prealloc_size = @test;
 select @@query_prealloc_size = @test;
 @@query_prealloc_size = @test
 1
+set global sql_mode=repeat('a',80);
+ERROR 42000: Variable 'sql_mode' can't be set to the value of
'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+End of 4.1 tests
diff -Nrup a/mysql-test/t/variables.test b/mysql-test/t/variables.test
--- a/mysql-test/t/variables.test	2006-12-05 10:45:17 +01:00
+++ b/mysql-test/t/variables.test	2007-10-18 10:47:52 +02:00
@@ -447,4 +447,11 @@ set @test = @@query_prealloc_size;
 set @@query_prealloc_size = @test;
 select @@query_prealloc_size = @test;
 
-# End of 4.1 tests
+#
+# Bug#31588 buffer overrun when setting variables
+#
+# Buffer-size Off By One. Should throw valgrind-warning without fix #31588.
+--error 1231
+set global sql_mode=repeat('a',80);
+
+--echo End of 4.1 tests
diff -Nrup a/sql/set_var.cc b/sql/set_var.cc
--- a/sql/set_var.cc	2007-05-08 09:09:24 +02:00
+++ b/sql/set_var.cc	2007-10-18 10:47:52 +02:00
@@ -1573,7 +1573,7 @@ bool sys_var::check_set(THD *thd, set_va
 					    &not_used));
     if (error_len)
     {
-      strmake(buff, error, min(sizeof(buff), error_len));
+      strmake(buff, error, min(sizeof(buff) - 1, error_len));
       goto err;
     }
   }