List:Commits« Previous MessageNext Message »
From:Kristofer Pettersson Date:September 1 2008 10:12am
Subject:bzr commit into mysql-6.0 branch (kpettersson:2810) Bug#39153
View as plain text  
#At file:///home/thek/Development/cpp/mysqlbzr/mysql-6.0-bugteam/

 2810 Kristofer Pettersson	2008-09-01
      Bug#39153 Failing to lookup a host name can lead to crash in current IPv6 implementation
      
      The reverse name lookup used to ensure the server that the client is who it says to be can
      fail. When it does it crashes because of an additional freeaddrinfo on an uninitialized
      structure.
      
      When a host name is added to the host name cache we do a memcpy on sockaddr_storage
      structures but uses the size of struct addrinfo. This also caused a crash.
modified:
  sql/hostname.cc

per-file messages:
  sql/hostname.cc
    * Memcpy memory block size isn't sizeof(struct addrinfo) but 
    sizeof(struct sockaddr_storage). This caused a crash.
    * Don't call freeaddrinfo if we failed to get a res_lst. (caused crash)
=== modified file 'sql/hostname.cc'
--- a/sql/hostname.cc	2008-07-08 16:01:41 +0000
+++ b/sql/hostname.cc	2008-09-01 10:11:50 +0000
@@ -94,7 +94,7 @@ static void add_hostname(struct sockaddr
       if ((entry=(host_entry*) malloc(sizeof(host_entry)+length+1)))
       {
 	char *new_name;
-	memcpy_fixed(&entry->ip, in, sizeof(struct addrinfo));
+	memcpy_fixed(&entry->ip, in, sizeof(struct sockaddr_storage));
 	if (length)
 	  memcpy(new_name= (char *) (entry+1), name, length+1);
 	else
@@ -239,7 +239,6 @@ char *ip_to_hostname(struct sockaddr_sto
       add_wrong_ip(in);
 
     my_free(name,MYF(0));
-    freeaddrinfo(res_lst);
     DBUG_RETURN(0);
   }
 

Thread
bzr commit into mysql-6.0 branch (kpettersson:2810) Bug#39153Kristofer Pettersson1 Sep