summaryrefslogtreecommitdiff
path: root/dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch
diff options
context:
space:
mode:
authorV3n3RiX <venerix@redcorelinux.org>2020-11-25 22:39:15 +0000
committerV3n3RiX <venerix@redcorelinux.org>2020-11-25 22:39:15 +0000
commitd934827bf44b7cfcf6711964418148fa60877668 (patch)
tree0625f358789b5e015e49db139cc1dbc9be00428f /dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch
parent2e34d110f164bf74d55fced27fe0000201b3eec5 (diff)
gentoo resync : 25.11.2020
Diffstat (limited to 'dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch')
-rw-r--r--dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch62
1 files changed, 62 insertions, 0 deletions
diff --git a/dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch b/dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch
new file mode 100644
index 000000000000..9658669c6e61
--- /dev/null
+++ b/dev-db/mariadb/files/mariadb-10.4-CVE-2020-15180.patch
@@ -0,0 +1,62 @@
+https://github.com/MariaDB/server/commit/418850b2df4256da5a722288c2657650dc228842
+
+--- a/sql/wsrep_sst.cc
++++ b/sql/wsrep_sst.cc
+@@ -1822,6 +1822,35 @@ static int sst_donate_other (const char* method,
+ return arg.err;
+ }
+
++/* return true if character can be a part of a filename */
++static bool filename_char(int const c)
++{
++ return isalnum(c) || (c == '-') || (c == '_') || (c == '.');
++}
++
++/* return true if character can be a part of an address string */
++static bool address_char(int const c)
++{
++ return filename_char(c) ||
++ (c == ':') || (c == '[') || (c == ']') || (c == '/');
++}
++
++static bool check_request_str(const char* const str,
++ bool (*check) (int c))
++{
++ for (size_t i(0); str[i] != '\0'; ++i)
++ {
++ if (!check(str[i]))
++ {
++ WSREP_WARN("Illegal character in state transfer request: %i (%c).",
++ str[i], str[i]);
++ return true;
++ }
++ }
++
++ return false;
++}
++
+ int wsrep_sst_donate(const std::string& msg,
+ const wsrep::gtid& current_gtid,
+ const bool bypass)
+@@ -1833,8 +1862,21 @@ int wsrep_sst_donate(const std::string& msg,
+
+ const char* method= msg.data();
+ size_t method_len= strlen (method);
++
++ if (check_request_str(method, filename_char))
++ {
++ WSREP_ERROR("Bad SST method name. SST canceled.");
++ return WSREP_CB_FAILURE;
++ }
++
+ const char* data= method + method_len + 1;
+
++ if (check_request_str(data, address_char))
++ {
++ WSREP_ERROR("Bad SST address string. SST canceled.");
++ return WSREP_CB_FAILURE;
++ }
++
+ wsp::env env(NULL);
+ if (env.error())
+ {