Skip to content

Commit 4e2a0c3

Browse files
committed
MDEV-10888: encryption.filekeys_emptyfile fails in buildbot with valgrind
Problem was that length of the filekeys file was not checked and if length is less than OpenSSL_prefix_len uninitialized memory was accessed.
1 parent d30809a commit 4e2a0c3

File tree

5 files changed

+19
-1
lines changed

5 files changed

+19
-1
lines changed
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
call mtr.add_suppression("Cannot decrypt .*tooshort.enc. Not encrypted");
2+
call mtr.add_suppression("Plugin 'file_key_management' init function returned error");
3+
call mtr.add_suppression("Plugin 'file_key_management' registration.*failed");
4+
FOUND /Cannot decrypt .*tooshort.enc. Not encrypted/ in mysqld.1.err
5+
create table t1(c1 bigint not null, b char(200)) engine=innodb encrypted=yes encryption_key_id=1;
6+
ERROR HY000: Can't create table `test`.`t1` (errno: 140 "Wrong create options")
7+
select plugin_status from information_schema.plugins
8+
where plugin_name = 'file_key_management';
9+
plugin_status
10+
# Test checks if opening an too short filekeys does not crash the server.
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Salted__
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
--loose-file-key-management-filekey=secret
2+
--loose-file-key-management-filename=$MTR_SUITE_DIR/t/filekeys-tooshort.enc
3+
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
let SEARCH_PATTERN=Cannot decrypt .*tooshort.enc. Not encrypted;
2+
source filekeys_badtest.inc;
3+
4+
--echo # Test checks if opening an too short filekeys does not crash the server.

plugin/file_key_management/parser.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -333,7 +333,7 @@ char* Parser::read_and_decrypt_file(const char *secret)
333333

334334
// Check for file encryption
335335
uchar *decrypted;
336-
if (is_prefix((char*)buffer, OpenSSL_prefix))
336+
if (file_size > OpenSSL_prefix_len && is_prefix((char*)buffer, OpenSSL_prefix))
337337
{
338338
uchar key[OpenSSL_key_len];
339339
uchar iv[OpenSSL_iv_len];

0 commit comments

Comments
 (0)