diff options
Diffstat (limited to 'dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch')
-rw-r--r-- | dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch | 62 |
1 files changed, 0 insertions, 62 deletions
diff --git a/dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch b/dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch deleted file mode 100644 index 9658669c6e61..000000000000 --- a/dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch +++ /dev/null @@ -1,62 +0,0 @@ -https://github.com/MariaDB/server/commit/418850b2df4256da5a722288c2657650dc228842 - ---- a/sql/wsrep_sst.cc -+++ b/sql/wsrep_sst.cc -@@ -1822,6 +1822,35 @@ static int sst_donate_other (const char* method, - return arg.err; - } - -+/* return true if character can be a part of a filename */ -+static bool filename_char(int const c) -+{ -+ return isalnum(c) || (c == '-') || (c == '_') || (c == '.'); -+} -+ -+/* return true if character can be a part of an address string */ -+static bool address_char(int const c) -+{ -+ return filename_char(c) || -+ (c == ':') || (c == '[') || (c == ']') || (c == '/'); -+} -+ -+static bool check_request_str(const char* const str, -+ bool (*check) (int c)) -+{ -+ for (size_t i(0); str[i] != '\0'; ++i) -+ { -+ if (!check(str[i])) -+ { -+ WSREP_WARN("Illegal character in state transfer request: %i (%c).", -+ str[i], str[i]); -+ return true; -+ } -+ } -+ -+ return false; -+} -+ - int wsrep_sst_donate(const std::string& msg, - const wsrep::gtid& current_gtid, - const bool bypass) -@@ -1833,8 +1862,21 @@ int wsrep_sst_donate(const std::string& msg, - - const char* method= msg.data(); - size_t method_len= strlen (method); -+ -+ if (check_request_str(method, filename_char)) -+ { -+ WSREP_ERROR("Bad SST method name. SST canceled."); -+ return WSREP_CB_FAILURE; -+ } -+ - const char* data= method + method_len + 1; - -+ if (check_request_str(data, address_char)) -+ { -+ WSREP_ERROR("Bad SST address string. SST canceled."); -+ return WSREP_CB_FAILURE; -+ } -+ - wsp::env env(NULL); - if (env.error()) - { |