File mysql-5.0.67-CVE-2008-2079.patch of Package mysql
From http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2672
---
include/myisam.h | 4 ++++
myisam/mi_check.c | 6 +++---
myisam/mi_open.c | 42 ++++++++++++++++++++++++++++++++++--------
myisam/mi_static.c | 9 +++++++++
myisam/myisamchk.c | 2 +-
myisam/myisamdef.h | 4 +++-
mysql-test/t/symlink.test | 4 ++--
sql/mysql_priv.h | 3 +++
sql/mysqld.cc | 11 ++++++++---
sql/sql_parse.cc | 33 ++++++++++++++++++++-------------
10 files changed, 87 insertions(+), 31 deletions(-)
--- include/myisam.h.orig
+++ include/myisam.h
@@ -267,6 +267,10 @@ extern my_bool myisam_flush,myisam_delay
extern my_off_t myisam_max_temp_length;
extern ulong myisam_bulk_insert_tree_size, myisam_data_pointer_size;
+/* usually used to check if a symlink points into the mysql data home */
+/* which is normally forbidden */
+extern int (*myisam_test_invalid_symlink)(const char *filename);
+
/* Prototypes for myisam-functions */
extern int mi_close(struct st_myisam_info *file);
--- myisam/mi_check.c.orig
+++ myisam/mi_check.c
@@ -1732,7 +1732,7 @@ err:
DATA_TMP_EXT, share->base.raid_chunks,
(param->testflag & T_BACKUP_DATA ?
MYF(MY_REDEL_MAKE_BACKUP): MYF(0))) ||
- mi_open_datafile(info,share,-1))
+ mi_open_datafile(info,share,name,-1))
got_error=1;
}
}
@@ -2519,7 +2519,7 @@ err:
DATA_TMP_EXT, share->base.raid_chunks,
(param->testflag & T_BACKUP_DATA ?
MYF(MY_REDEL_MAKE_BACKUP): MYF(0))) ||
- mi_open_datafile(info,share,-1))
+ mi_open_datafile(info,share,name,-1))
got_error=1;
}
}
@@ -3050,7 +3050,7 @@ err:
DATA_TMP_EXT, share->base.raid_chunks,
(param->testflag & T_BACKUP_DATA ?
MYF(MY_REDEL_MAKE_BACKUP): MYF(0))) ||
- mi_open_datafile(info,share,-1))
+ mi_open_datafile(info,share,name,-1))
got_error=1;
}
}
--- myisam/mi_open.c.orig
+++ myisam/mi_open.c
@@ -74,7 +74,7 @@ MI_INFO *test_if_reopen(char *filename)
MI_INFO *mi_open(const char *name, int mode, uint open_flags)
{
- int lock_error,kfile,open_mode,save_errno,have_rtree=0;
+ int lock_error,kfile,open_mode,save_errno,have_rtree=0, realpath_err;
uint i,j,len,errpos,head_length,base_pos,offset,info_length,keys,
key_parts,unique_key_parts,fulltext_keys,uniques;
char name_buff[FN_REFLEN], org_name[FN_REFLEN], index_name[FN_REFLEN],
@@ -94,7 +94,16 @@ MI_INFO *mi_open(const char *name, int m
head_length=sizeof(share_buff.state.header);
bzero((byte*) &info,sizeof(info));
- my_realpath(name_buff, fn_format(org_name,name,"",MI_NAME_IEXT,4),MYF(0));
+ realpath_err= my_realpath(name_buff,
+ fn_format(org_name,name,"",MI_NAME_IEXT,4),MYF(0));
+ if (my_is_symlink(org_name) &&
+ (realpath_err || (*myisam_test_invalid_symlink)(name_buff)))
+ {
+ my_errno= HA_WRONG_CREATE_OPTION;
+ DBUG_RETURN (NULL);
+ }
+
+
pthread_mutex_lock(&THR_LOCK_myisam);
if (!(old_info=test_if_reopen(name_buff)))
{
@@ -463,7 +472,7 @@ MI_INFO *mi_open(const char *name, int m
lock_error=1; /* Database unlocked */
}
- if (mi_open_datafile(&info, share, -1))
+ if (mi_open_datafile(&info, share, name, -1))
goto err;
errpos=5;
@@ -534,7 +543,7 @@ MI_INFO *mi_open(const char *name, int m
my_errno=EACCES; /* Can't open in write mode */
goto err;
}
- if (mi_open_datafile(&info, share, old_info->dfile))
+ if (mi_open_datafile(&info, share, name, old_info->dfile))
goto err;
errpos=5;
have_rtree= old_info->rtree_recursion_state != NULL;
@@ -1191,12 +1200,30 @@ The argument file_to_dup is here for the
exist a dup()-like call that would give us two different file descriptors.
*************************************************************************/
-int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share, File file_to_dup __attribute__((unused)))
+int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share, const char *org_name,
+ File file_to_dup __attribute__((unused)))
{
+ char *data_name= share->data_file_name;
+ char real_data_name[FN_REFLEN];
+
+ if (org_name)
+ {
+ fn_format(real_data_name,org_name,"",MI_NAME_DEXT,4);
+ if (my_is_symlink(real_data_name))
+ {
+ if (my_realpath(real_data_name, real_data_name, MYF(0)) ||
+ (*myisam_test_invalid_symlink)(real_data_name))
+ {
+ my_errno= HA_WRONG_CREATE_OPTION;
+ return 1;
+ }
+ data_name= real_data_name;
+ }
+ }
#ifdef USE_RAID
if (share->base.raid_type)
{
- info->dfile=my_raid_open(share->data_file_name,
+ info->dfile=my_raid_open(data_name,
share->mode | O_SHARE,
share->base.raid_type,
share->base.raid_chunks,
@@ -1205,8 +1232,7 @@ int mi_open_datafile(MI_INFO *info, MYIS
}
else
#endif
- info->dfile=my_open(share->data_file_name, share->mode | O_SHARE,
- MYF(MY_WME));
+ info->dfile=my_open(data_name, share->mode | O_SHARE, MYF(MY_WME));
return info->dfile >= 0 ? 0 : 1;
}
--- myisam/mi_static.c.orig
+++ myisam/mi_static.c
@@ -41,6 +41,15 @@ my_off_t myisam_max_temp_length= MAX_FIL
ulong myisam_bulk_insert_tree_size=8192*1024;
ulong myisam_data_pointer_size=4;
+
+static int always_valid(const char *filename)
+{
+ return 0;
+}
+
+int (*myisam_test_invalid_symlink)(const char *filename)= always_valid;
+
+
/*
read_vec[] is used for converting between P_READ_KEY.. and SEARCH_
Position is , == , >= , <= , > , <
--- myisam/myisamchk.c.orig
+++ myisam/myisamchk.c
@@ -1039,7 +1039,7 @@ static int myisamchk(MI_CHECK *param, my
error|=change_to_newfile(filename,MI_NAME_DEXT,DATA_TMP_EXT,
raid_chunks,
MYF(0));
- if (mi_open_datafile(info,info->s, -1))
+ if (mi_open_datafile(info,info->s, NULL, -1))
error=1;
param->out_flag&= ~O_NEW_DATA; /* We are using new datafile */
param->read_cache.file=info->dfile;
--- myisam/myisamdef.h.orig
+++ myisam/myisamdef.h
@@ -739,7 +739,9 @@ void mi_disable_non_unique_index(MI_INFO
extern MI_INFO *test_if_reopen(char *filename);
my_bool check_table_is_closed(const char *name, const char *where);
-int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share, File file_to_dup);
+int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share, const char *orn_name,
+ File file_to_dup);
+
int mi_open_keyfile(MYISAM_SHARE *share);
void mi_setup_functions(register MYISAM_SHARE *share);
--- mysql-test/t/symlink.test.orig
+++ mysql-test/t/symlink.test
@@ -71,7 +71,7 @@ drop table t1;
SHOW CREATE TABLE t9;
disable_query_log;
---error 1103,1103
+--error 1210, 1210
create table t1 (a int not null auto_increment, b char(16) not null, primary key (a)) engine=myisam data directory="tmp";
# Check that we cannot link over a table from another database.
@@ -81,7 +81,7 @@ create database mysqltest;
--error 1,1
create table mysqltest.t9 (a int not null auto_increment, b char(16) not null, primary key (a)) engine=myisam index directory="/this-dir-does-not-exist";
---error 1103,1103
+--error 1210, 1210
create table mysqltest.t9 (a int not null auto_increment, b char(16) not null, primary key (a)) engine=myisam index directory="not-hard-path";
# Should fail becasue the file t9.MYI already exist in 'run'
--- sql/mysql_priv.h.orig
+++ sql/mysql_priv.h
@@ -1284,6 +1284,7 @@ extern char *mysql_data_home,server_vers
mysql_real_data_home[], *opt_mysql_tmpdir, mysql_charsets_dir[],
mysql_unpacked_real_data_home[],
def_ft_boolean_syntax[sizeof(ft_boolean_syntax)];
+extern int mysql_unpacked_real_data_home_len;
#define mysql_tmpdir (my_tmpdir(&mysql_tmpdir_list))
extern MY_TMPDIR mysql_tmpdir_list;
extern const char *command_name[];
@@ -1787,6 +1788,8 @@ inline void kill_delayed_threads(void) {
#define check_stack_overrun(A, B, C) 0
#endif
+extern "C" int test_if_data_home_dir(const char *dir);
+
#endif /* MYSQL_CLIENT */
#endif
--- sql/mysqld.cc.orig
+++ sql/mysqld.cc
@@ -480,6 +480,7 @@ char mysql_real_data_home[FN_REFLEN],
*opt_init_file, *opt_tc_log_file,
mysql_unpacked_real_data_home[FN_REFLEN],
def_ft_boolean_syntax[sizeof(ft_boolean_syntax)];
+int mysql_unpacked_real_data_home_len;
char *mysql_data_home= mysql_real_data_home;
const key_map key_map_empty(0);
key_map key_map_full(0); // Will be initialized later
@@ -6712,6 +6713,7 @@ static void mysql_init_variables(void)
/* Things reset to zero */
opt_skip_slave_start= opt_reckless_slave = 0;
mysql_home[0]= pidfile_name[0]= log_error_file[0]= 0;
+ myisam_test_invalid_symlink= test_if_data_home_dir;
opt_log= opt_slow_log= 0;
opt_update_log= 0;
opt_bin_log= 0;
@@ -7762,9 +7764,12 @@ static void fix_paths(void)
pos[1]= 0;
}
convert_dirname(mysql_real_data_home,mysql_real_data_home,NullS);
- (void) fn_format(buff, mysql_real_data_home, "", "",
- (MY_RETURN_REAL_PATH|MY_RESOLVE_SYMLINKS));
- (void) unpack_dirname(mysql_unpacked_real_data_home, buff);
+ my_realpath(mysql_unpacked_real_data_home, mysql_real_data_home, MYF(0));
+ mysql_unpacked_real_data_home_len= strlen(mysql_unpacked_real_data_home);
+ if (mysql_unpacked_real_data_home[mysql_unpacked_real_data_home_len-1] == FN_LIBCHAR)
+ --mysql_unpacked_real_data_home_len;
+
+
convert_dirname(language,language,NullS);
(void) my_load_path(mysql_home,mysql_home,""); // Resolve current dir
(void) my_load_path(mysql_real_data_home,mysql_real_data_home,mysql_home);
--- sql/sql_parse.cc.orig
+++ sql/sql_parse.cc
@@ -76,7 +76,6 @@ static void remove_escape(char *name);
static bool append_file_to_dir(THD *thd, const char **filename_ptr,
const char *table_name);
static bool check_show_create_table_access(THD *thd, TABLE_LIST *table);
-static bool test_if_data_home_dir(const char *dir);
const char *any_db="*any*"; // Special symbol for check_access
@@ -3097,13 +3096,13 @@ mysql_execute_command(THD *thd)
if (test_if_data_home_dir(lex->create_info.data_file_name))
{
- my_error(ER_WRONG_ARGUMENTS,MYF(0),"DATA DIRECORY");
+ my_error(ER_WRONG_ARGUMENTS,MYF(0),"DATA DIRECTORY");
res= -1;
break;
}
if (test_if_data_home_dir(lex->create_info.index_file_name))
{
- my_error(ER_WRONG_ARGUMENTS,MYF(0),"INDEX DIRECORY");
+ my_error(ER_WRONG_ARGUMENTS,MYF(0),"INDEX DIRECTORY");
res= -1;
break;
}
@@ -7974,10 +7973,12 @@ bool check_string_length(LEX_STRING *str
1 error
*/
-static bool test_if_data_home_dir(const char *dir)
+C_MODE_START
+
+int test_if_data_home_dir(const char *dir)
{
- char path[FN_REFLEN], conv_path[FN_REFLEN];
- uint dir_len, home_dir_len= strlen(mysql_unpacked_real_data_home);
+ char path[FN_REFLEN];
+ uint dir_len;
DBUG_ENTER("test_if_data_home_dir");
if (!dir)
@@ -7985,21 +7986,27 @@ static bool test_if_data_home_dir(const
(void) fn_format(path, dir, "", "",
(MY_RETURN_REAL_PATH|MY_RESOLVE_SYMLINKS));
- dir_len= unpack_dirname(conv_path, dir);
-
- if (home_dir_len <= dir_len)
+ dir_len= strlen(path);
+ if (mysql_unpacked_real_data_home_len<= dir_len)
{
+ if (dir_len > mysql_unpacked_real_data_home_len &&
+ path[mysql_unpacked_real_data_home_len] != FN_LIBCHAR)
+ DBUG_RETURN(0);
+
if (lower_case_file_system)
{
- if (!my_strnncoll(default_charset_info, (const uchar*) conv_path,
- home_dir_len,
+ if (!my_strnncoll(default_charset_info, (const uchar*) path,
+ mysql_unpacked_real_data_home_len,
(const uchar*) mysql_unpacked_real_data_home,
- home_dir_len))
+ mysql_unpacked_real_data_home_len))
DBUG_RETURN(1);
}
- else if (!memcmp(conv_path, mysql_unpacked_real_data_home, home_dir_len))
+ else if (!memcmp(path, mysql_unpacked_real_data_home,
+ mysql_unpacked_real_data_home_len))
DBUG_RETURN(1);
}
DBUG_RETURN(0);
}
+C_MODE_END
+
