You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

89 lines
5.3 KiB

Bug#17583: mysql drops connection when stdout is not writable When the client program had its stdout file descriptor closed by the calling shell, after some amount of work (enough to fill a socket buffer) the server would complain about a packet error and then disconnect the client. This is a serious security problem. If stdout is closed before the mysql is exec()d, then the first socket() call allocates file number 1 to communicate with the server. Subsequent write()s to that file number (as when printing results that come back from the database) go back to the server instead in the command channel. So, one should be able to craft data which, upon being selected back from the server to the client, and injected into the command stream become valid MySQL protocol to do something nasty when sent /back/ to the server. The solution is to close explicitly the file descriptor that we *printf() to, so that the libc layer and the OS layer both agree that the file is closed. BitKeeper/etc/collapsed: BitKeeper file /home/cmiller/work/mysql/bug17583/my41-bug17583/BitKeeper/etc/collapsed client/mysql.cc: If standard output is not open (specifically, if dup() of its file number fails) then we explicitly close it so that future uses of the file descriptor behave correctly for a closed file. mysql-test/r/mysql_client.result: Prove that the problem of writing SQL output to the command socket no longer exists. mysql-test/t/mysql_client.test: Prove that the problem of writing SQL output to the command socket no longer exists.
19 years ago
Bug#17583: mysql drops connection when stdout is not writable When the client program had its stdout file descriptor closed by the calling shell, after some amount of work (enough to fill a socket buffer) the server would complain about a packet error and then disconnect the client. This is a serious security problem. If stdout is closed before the mysql is exec()d, then the first socket() call allocates file number 1 to communicate with the server. Subsequent write()s to that file number (as when printing results that come back from the database) go back to the server instead in the command channel. So, one should be able to craft data which, upon being selected back from the server to the client, and injected into the command stream become valid MySQL protocol to do something nasty when sent /back/ to the server. The solution is to close explicitly the file descriptor that we *printf() to, so that the libc layer and the OS layer both agree that the file is closed. BitKeeper/etc/collapsed: BitKeeper file /home/cmiller/work/mysql/bug17583/my41-bug17583/BitKeeper/etc/collapsed client/mysql.cc: If standard output is not open (specifically, if dup() of its file number fails) then we explicitly close it so that future uses of the file descriptor behave correctly for a closed file. mysql-test/r/mysql_client.result: Prove that the problem of writing SQL output to the command socket no longer exists. mysql-test/t/mysql_client.test: Prove that the problem of writing SQL output to the command socket no longer exists.
19 years ago
Bug#17583: mysql drops connection when stdout is not writable When the client program had its stdout file descriptor closed by the calling shell, after some amount of work (enough to fill a socket buffer) the server would complain about a packet error and then disconnect the client. This is a serious security problem. If stdout is closed before the mysql is exec()d, then the first socket() call allocates file number 1 to communicate with the server. Subsequent write()s to that file number (as when printing results that come back from the database) go back to the server instead in the command channel. So, one should be able to craft data which, upon being selected back from the server to the client, and injected into the command stream become valid MySQL protocol to do something nasty when sent /back/ to the server. The solution is to close explicitly the file descriptor that we *printf() to, so that the libc layer and the OS layer both agree that the file is closed. BitKeeper/etc/collapsed: BitKeeper file /home/cmiller/work/mysql/bug17583/my41-bug17583/BitKeeper/etc/collapsed client/mysql.cc: If standard output is not open (specifically, if dup() of its file number fails) then we explicitly close it so that future uses of the file descriptor behave correctly for a closed file. mysql-test/r/mysql_client.result: Prove that the problem of writing SQL output to the command socket no longer exists. mysql-test/t/mysql_client.test: Prove that the problem of writing SQL output to the command socket no longer exists.
19 years ago
  1. # This test should work in embedded server after we fix mysqltest
  2. -- source include/not_embedded.inc
  3. #
  4. # Bug #20432: mysql client interprets commands in comments
  5. #
  6. # if the client sees the 'use' within the comment, we haven't fixed
  7. --exec echo "/*" > $MYSQLTEST_VARDIR/tmp/bug20432.sql
  8. --exec echo "use" >> $MYSQLTEST_VARDIR/tmp/bug20432.sql
  9. --exec echo "*/" >> $MYSQLTEST_VARDIR/tmp/bug20432.sql
  10. --exec $MYSQL < $MYSQLTEST_VARDIR/tmp/bug20432.sql 2>&1
  11. # SQL can have embedded comments => workie
  12. --exec echo "select /*" > $MYSQLTEST_VARDIR/tmp/bug20432.sql
  13. --exec echo "use" >> $MYSQLTEST_VARDIR/tmp/bug20432.sql
  14. --exec echo "*/ 1" >> $MYSQLTEST_VARDIR/tmp/bug20432.sql
  15. --exec $MYSQL < $MYSQLTEST_VARDIR/tmp/bug20432.sql 2>&1
  16. # client commands on the other hand must be at BOL => error
  17. --exec echo "/*" > $MYSQLTEST_VARDIR/tmp/bug20432.sql
  18. --exec echo "xxx" >> $MYSQLTEST_VARDIR/tmp/bug20432.sql
  19. --exec echo "*/ use" >> $MYSQLTEST_VARDIR/tmp/bug20432.sql
  20. --error 1
  21. --exec $MYSQL < $MYSQLTEST_VARDIR/tmp/bug20432.sql 2>&1
  22. # client comment recognized, but parameter missing => error
  23. --exec echo "use" > $MYSQLTEST_VARDIR/tmp/bug20432.sql
  24. --exec $MYSQL < $MYSQLTEST_VARDIR/tmp/bug20432.sql 2>&1
  25. #
  26. # Bug #20328: mysql client: dumb about trailing spaces on 'help' command
  27. #
  28. --exec echo 'help' | $MYSQL > $MYSQLTEST_VARDIR/tmp/bug20328.tmp
  29. --exec echo 'help ' | $MYSQL > $MYSQLTEST_VARDIR/tmp/bug20328.tmp
  30. #
  31. # Bug #19216: Client crashes on long SELECT
  32. #
  33. --exec echo "select" > $MYSQLTEST_VARDIR/tmp/b19216.tmp
  34. # 3400 * 20 makes 68000 columns that is more than the max number that can fit
  35. # in a 16 bit number.
  36. let $i= 3400;
  37. while ($i)
  38. {
  39. --exec echo "'a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a'," >> $MYSQLTEST_VARDIR/tmp/b19216.tmp
  40. dec $i;
  41. }
  42. --exec echo "'b';" >> $MYSQLTEST_VARDIR/tmp/b19216.tmp
  43. --disable_query_log
  44. --exec $MYSQL < $MYSQLTEST_VARDIR/tmp/b19216.tmp >/dev/null
  45. --enable_query_log
  46. #
  47. # Bug#17583: mysql drops connection when stdout is not writable
  48. #
  49. create table t17583 (a int);
  50. insert into t17583 (a) values (0),(1),(2),(3),(4),(5),(6),(7),(8),(9);
  51. insert into t17583 select a from t17583;
  52. insert into t17583 select a from t17583;
  53. insert into t17583 select a from t17583;
  54. insert into t17583 select a from t17583;
  55. insert into t17583 select a from t17583;
  56. insert into t17583 select a from t17583;
  57. insert into t17583 select a from t17583;
  58. # Close to the minimal data needed to exercise bug.
  59. select count(*) from t17583;
  60. --exec echo "select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; select count(*) from t17583; " |$MYSQL test >&-
  61. drop table t17583;
  62. #
  63. # Bug #19216: Client crashes on long SELECT
  64. #
  65. --exec echo "select" > $MYSQLTEST_VARDIR/tmp/b19216.tmp
  66. # 3400 * 20 makes 68000 columns that is more than the max number that can fit
  67. # in a 16 bit number.
  68. let $i= 3400;
  69. while ($i)
  70. {
  71. --exec echo "'a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a','a'," >> $MYSQLTEST_VARDIR/tmp/b19216.tmp
  72. dec $i;
  73. }
  74. --exec echo "'b';" >> $MYSQLTEST_VARDIR/tmp/b19216.tmp
  75. --disable_query_log
  76. --exec $MYSQL < $MYSQLTEST_VARDIR/tmp/b19216.tmp >/dev/null
  77. --enable_query_log
  78. --echo End of 4.1 tests.