Merge pull request #4059 from sysown/v2.x-fix_empty_query_buf_overflow

Fix invalid memory accesses when handling empty queries

include/MySQL_Data_Stream.h

@@ -35,8 +35,12 @@ class MyDS_real_query {
 */
 		pkt.ptr=_pkt->ptr;
 		pkt.size=_pkt->size;
-		QueryPtr=(char *)pkt.ptr+5;
 		QuerySize=pkt.size-5;
+		if (QuerySize == 0) {
+			QueryPtr=const_cast<char*>("");
+		} else {
+			QueryPtr=(char *)pkt.ptr+5;
+		}
 	}
 	void end() {
 		l_free(pkt.size,pkt.ptr);

lib/MySQL_Session.cpp

@@ -871,6 +871,7 @@ void MySQL_Session::writeout() {
 }
 
 bool MySQL_Session::handler_CommitRollback(PtrSize_t *pkt) {
+	if (pkt->size <= 5) { return false; }
 	char c=((char *)pkt->ptr)[5];
 	bool ret=false;
 	if (c=='c' || c=='C') {

test/tap/tests/test_empty_query-t.cpp

@@ -0,0 +1,50 @@
+/**
+ * @file test_empty_query-t.cpp
+ * @brief Simple test checking that empty queries are properly handled by ProxySQL.
+ */
+
+#include "mysql.h"
+#include "tap.h"
+#include "command_line.h"
+#include "utils.h"
+
+uint32_t EXECUTIONS = 100;
+
+int main(int argc, char** argv) {
+	plan(1);
+
+	CommandLine cl;
+
+	if (cl.getEnv()) {
+		diag("Failed to get the required environmental variables.");
+		return EXIT_FAILURE;
+	}
+
+	MYSQL* proxy = mysql_init(NULL);
+
+	if (!mysql_real_connect(proxy, cl.host, cl.username, cl.password, NULL, cl.port, NULL, 0)) {
+		fprintf(stderr, "File %s, line %d, Error: %s\n", __FILE__, __LINE__, mysql_error(proxy));
+		return EXIT_FAILURE;
+	}
+
+	int exp_myerr = 1065;
+	int act_myerr = 0;
+
+	for (uint32_t i = 0; i < EXECUTIONS; i++) {
+		mysql_query(proxy, "");
+		act_myerr = mysql_errno(proxy);
+
+		if (exp_myerr != act_myerr) {
+			break;
+		}
+	}
+
+	ok(
+		exp_myerr == act_myerr, "MySQL error equals expected - exp_err: '%d', act_err: '%d' error: `%s`",
+		exp_myerr, act_myerr, mysql_error(proxy)
+	);
+
+	mysql_close(proxy);
+
+	return exit_status();
+}