From a2e5235b927deedc1decdf655c8283b19adc9069 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 21 May 2006 16:10:28 +0000 Subject: [PATCH] Fixed a possible buffer overflow inside create_named_pipe() for Win32 systems in libmysql.c. --- NEWS | 2 ++ ext/mysql/libmysql/libmysql.c | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/NEWS b/NEWS index 4557cf66b9..2ee7e5de68 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,8 @@ PHP 4 NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2006, Version 4.4.3 +- Fixed a possible buffer overflow inside create_named_pipe() for Win32 systems + in libmysql.c. (Ilia) - Updated PCRE to version 6.6. (Andrei) - Added overflow checks to wordwrap() function. (Ilia) - Added a check for special characters in the session name. (Ilia) diff --git a/ext/mysql/libmysql/libmysql.c b/ext/mysql/libmysql/libmysql.c index 94d6352252..a1f7a4520c 100644 --- a/ext/mysql/libmysql/libmysql.c +++ b/ext/mysql/libmysql/libmysql.c @@ -213,6 +213,10 @@ HANDLE create_named_pipe(NET *net, uint connect_timeout, char **arg_host, if (!host || !strcmp(host,LOCAL_HOST)) host=LOCAL_HOST_NAMEDPIPE; + if (sizeof(szPipeName) <= (strlen(host) + strlen(unix_socket) + sizeof("\\\\\\pipe\\"))) { + return INVALID_HANDLE_VALUE; + } + sprintf( szPipeName, "\\\\%s\\pipe\\%s", host, unix_socket); DBUG_PRINT("info",("Server name: '%s'. Named Pipe: %s", host, unix_socket)); -- 2.50.1