From 96f179f943954f3e04e1f1d65ba9ecbb3d0bd320 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Canna=C3=B2?= Date: Sun, 16 Dec 2018 20:39:34 +1100 Subject: [PATCH] Prevent a buffer overflow in SELECT @@version --- lib/ProxySQL_Admin.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/ProxySQL_Admin.cpp b/lib/ProxySQL_Admin.cpp index 1a6495882..dcc8b5528 100644 --- a/lib/ProxySQL_Admin.cpp +++ b/lib/ProxySQL_Admin.cpp @@ -2657,7 +2657,7 @@ void admin_session_handler(MySQL_Session *sess, void *_pa, PtrSize_t *pkt) { if (!strncasecmp("SELECT @@version", query_no_space, strlen("SELECT @@version"))) { l_free(query_length,query); char *q=(char *)"SELECT '%s' AS '@@version'"; - query_length=strlen(q)+20; + query_length=strlen(q)+20+strlen(PROXYSQL_VERSION); query=(char *)l_alloc(query_length); sprintf(query,q,PROXYSQL_VERSION); goto __run_query; @@ -2666,7 +2666,7 @@ void admin_session_handler(MySQL_Session *sess, void *_pa, PtrSize_t *pkt) { if (!strncasecmp("SELECT version()", query_no_space, strlen("SELECT version()"))) { l_free(query_length,query); char *q=(char *)"SELECT '%s' AS 'version()'"; - query_length=strlen(q)+20; + query_length=strlen(q)+20+strlen(PROXYSQL_VERSION); query=(char *)l_alloc(query_length); sprintf(query,q,PROXYSQL_VERSION); goto __run_query;