Minimize unsafe C functions usage - replace strcat() and strcpy() (an…

…d strncat() and strncpy()) with custom safe_strcat() and safe_strcpy() functions

The MariaDB code base uses strcat() and strcpy() in several
places. These are known to have memory safety issues and their usage is
discouraged. Common security scanners like Flawfinder flags them. In MariaDB we
should start using modern and safer variants on these functions.

This is similar to memory issues fixes in 19af189
and 9de9f10 but now replace use of strcat()
and strcpy() with safer options strncat() and strncpy().

However, add '\0' forcefully to make sure the result string is correct since
for these two functions it is not guaranteed what new string will be null-terminated.

Example:

    size_t dest_len = sizeof(g->Message);
    strncpy(g->Message, "Null json tree", dest_len); strncat(g->Message, ":",
    sizeof(g->Message) - strlen(g->Message)); size_t wrote_sz = strlen(g->Message);
    size_t cur_len = wrote_sz >= dest_len ? dest_len - 1 : wrote_sz;
    g->Message[cur_len] = '\0';

All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the BSD-new
license. I am contributing on behalf of my employer Amazon Web Services

-- Reviewer and co-author Vicențiu Ciorbaru <vicentiu@mariadb.org>
-- Reviewer additions:
* The initial function implementation was flawed. Replaced with a simpler
  and also correct version.
* Simplified code by making use of snprintf instead of chaining strcat.
* Simplified code by removing dynamic string construction in the first
  place and using static strings if possible. See connect storage engine
  changes.

client/mysql_plugin.c

@@ -569,14 +569,14 @@ static int file_exists(char * filename)
   @retval int error = 1, success = 0
 */
 
-static int search_dir(const char * base_path, const char *tool_name,
+static int search_dir(const char *base_path, const char *tool_name,
                       const char *subdir, char *tool_path)
 {
   char new_path[FN_REFLEN];
   char source_path[FN_REFLEN];
 
-  strcpy(source_path, base_path);
-  strcat(source_path, subdir);
+  safe_strcpy(source_path, sizeof(source_path), base_path);
+  safe_strcat(source_path, sizeof(source_path), subdir);
   fn_format(new_path, tool_name, source_path, "", MY_UNPACK_FILENAME);
   if (file_exists(new_path))
   {
@@ -632,7 +632,7 @@ static int load_plugin_data(char *plugin_name, char *config_file)
   FILE *file_ptr;
   char path[FN_REFLEN];
   char line[1024];
-  char *reason= 0;
+  const char *reason= 0;
   char *res;
   int i= -1;
 
@@ -643,14 +643,14 @@ static int load_plugin_data(char *plugin_name, char *config_file)
   }
   if (!file_exists(opt_plugin_ini))
   {
-    reason= (char *)"File does not exist.";
+    reason= "File does not exist.";
     goto error;
   }
 
   file_ptr= fopen(opt_plugin_ini, "r");
   if (file_ptr == NULL)
   {
-    reason= (char *)"Cannot open file.";
+    reason= "Cannot open file.";
     goto error;
   }
 
@@ -660,17 +660,20 @@ static int load_plugin_data(char *plugin_name, char *config_file)
   /* Read plugin components */
   while (i < 16)
   {
+    size_t line_len;
+
     res= fgets(line, sizeof(line), file_ptr);
+    line_len= strlen(line);
+
     /* strip /n */
-    if (line[strlen(line)-1] == '\n')
-    {
-      line[strlen(line)-1]= '\0';
-    }
+    if (line[line_len - 1] == '\n')
+      line[line_len - 1]= '\0';
+
     if (res == NULL)
     {
       if (i < 1)
       {
-        reason= (char *)"Bad format in plugin configuration file.";
+        reason= "Bad format in plugin configuration file.";
         fclose(file_ptr);
         goto error;        
       }
@@ -683,14 +686,19 @@ static int load_plugin_data(char *plugin_name, char *config_file)
     if (i == -1) /* if first pass, read this line as so_name */
     {
       /* Add proper file extension for soname */
-      strcat(line, FN_SOEXT);
+      if (safe_strcpy(line + line_len - 1, sizeof(line), FN_SOEXT))
+      {
+        reason= "Plugin name too long.";
+        fclose(file_ptr);
+        goto error;
+      }
       /* save so_name */
       plugin_data.so_name= my_strdup(line, MYF(MY_WME|MY_ZEROFILL));
       i++;
     }
     else
     {
-      if (strlen(line) > 0)
+      if (line_len > 0)
       {
         plugin_data.components[i]= my_strdup(line, MYF(MY_WME));
         i++;
@@ -779,14 +787,13 @@ static int check_options(int argc, char **argv, char *operation)
     /* read the plugin config file and check for match against argument */
     else
     {
-      if (strlen(argv[i]) + 4 + 1 > FN_REFLEN)
+      if (safe_strcpy(plugin_name, sizeof(plugin_name), argv[i]) ||
+          safe_strcpy(config_file, sizeof(config_file), argv[i]) ||
+          safe_strcat(config_file, sizeof(config_file), ".ini"))
       {
         fprintf(stderr, "ERROR: argument is too long.\n");
         return 1;
       }
-      strcpy(plugin_name, argv[i]);
-      strcpy(config_file, argv[i]);
-      strcat(config_file, ".ini");
     }
   }
 
@@ -855,35 +862,30 @@ static int check_options(int argc, char **argv, char *operation)
 static int process_options(int argc, char *argv[], char *operation)
 {
   int error= 0;
-  int i= 0;
 
   /* Parse and execute command-line options */
   if ((error= handle_options(&argc, &argv, my_long_options, get_one_option)))
-    goto exit;
+    return error;
 
   /* If the print defaults option used, exit. */
   if (opt_print_defaults)
-  {
-    error= -1;
-    goto exit;
-  }
+    return -1;
 
   /* Add a trailing directory separator if not present */
   if (opt_basedir)
   {
-    i= (int)strlength(opt_basedir);
-    if (opt_basedir[i-1] != FN_LIBCHAR || opt_basedir[i-1] != FN_LIBCHAR2)
+    size_t basedir_len= strlength(opt_basedir);
+    if (opt_basedir[basedir_len - 1] != FN_LIBCHAR ||
+        opt_basedir[basedir_len - 1] != FN_LIBCHAR2)
     {
       char buff[FN_REFLEN];
-      memset(buff, 0, sizeof(buff));
+      if (basedir_len + 2 > FN_REFLEN)
+        return -1;
 
-      strncpy(buff, opt_basedir, sizeof(buff) - 1);
-#ifdef __WIN__
-      strncat(buff, "/", sizeof(buff) - strlen(buff) - 1);
-#else
-      strncat(buff, FN_DIRSEP, sizeof(buff) - strlen(buff) - 1);
-#endif
-      buff[sizeof(buff) - 1]= 0;
+      memcpy(buff, opt_basedir, basedir_len);
+      buff[basedir_len]= '/';
+      buff[basedir_len + 1]= '\0';
+
       my_free(opt_basedir);
       opt_basedir= my_strdup(buff, MYF(MY_FAE));
     }
@@ -895,22 +897,17 @@ static int process_options(int argc, char *argv[], char *operation)
     generated when the defaults were read from the file, exit.
   */
   if (!opt_no_defaults && ((error= get_default_values())))
-  {
-    error= -1;
-    goto exit;
-  }
+    return -1;
 
   /*
    Check to ensure required options are present and validate the operation.
    Note: this method also validates the plugin specified by attempting to
    read a configuration file named <plugin_name>.ini from the --plugin-dir
    or --plugin-ini location if the --plugin-ini option presented.
   */
-  strcpy(operation, "");
-  if ((error = check_options(argc, argv, operation)))
-  {
-    goto exit;
-  }
+  operation[0]= '\0';
+  if ((error= check_options(argc, argv, operation)))
+    return error;
 
   if (opt_verbose)
   {
@@ -922,8 +919,7 @@ static int process_options(int argc, char *argv[], char *operation)
       printf("# lc_messages_dir = %s\n", opt_lc_messages_dir);
   }
 
-exit:
-  return error;
+  return 0;
 }
 
 

client/mysqldump.c

@@ -2478,7 +2478,7 @@ static uint dump_events_for_db(char *db)
   if (mysql_query_with_error_report(mysql, &event_list_res, "show events"))
     DBUG_RETURN(0);
 
-  strcpy(delimiter, ";");
+  safe_strcpy(delimiter, sizeof(delimiter), ";");
   if (mysql_num_rows(event_list_res) > 0)
   {
     if (opt_xml)

client/mysqltest.cc

@@ -6171,7 +6171,9 @@ int do_done(struct st_command *command)
     if (*cur_block->delim) 
     {
       /* Restore "old" delimiter after false if block */
-      strcpy (delimiter, cur_block->delim);
+      if (safe_strcpy(delimiter, sizeof(delimiter), cur_block->delim))
+        die("Delimiter too long, truncated");
+
       delimiter_length= strlen(delimiter);
     }
     /* Pop block from stack, goto next line */
@@ -6426,10 +6428,12 @@ void do_block(enum block_cmd cmd, struct st_command* command)
   if (cur_block->ok) 
   {
     cur_block->delim[0]= '\0';
-  } else
+  }
+  else
   {
     /* Remember "old" delimiter if entering a false if block */
-    strcpy (cur_block->delim, delimiter);
+    if (safe_strcpy(cur_block->delim, sizeof(cur_block->delim), delimiter))
+      die("Delimiter too long, truncated");
   }
 
   DBUG_PRINT("info", ("OK: %d", cur_block->ok));
@@ -11301,9 +11305,8 @@ static int setenv(const char *name, const char *value, int overwrite)
   char *envvar= (char *)malloc(buflen);
   if(!envvar)
     return ENOMEM;
-  strcpy(envvar, name);
-  strcat(envvar, "=");
-  strcat(envvar, value);
+
+  snprintf(envvar, buflen, "%s=%s", name, value);
   putenv(envvar);
   return 0;
 }

dbug/dbug.c

@@ -508,7 +508,7 @@ static int DbugParse(CODE_STATE *cs, const char *control)
     stack->delay= stack->next->delay;
     stack->maxdepth= stack->next->maxdepth;
     stack->sub_level= stack->next->sub_level;
-    strcpy(stack->name, stack->next->name);
+    safe_strcpy(stack->name, sizeof(stack->name), stack->next->name);
     stack->out_file= stack->next->out_file;
     stack->out_file->used++;
     if (stack->next == &init_settings)

extra/innochecksum.cc

@@ -844,19 +844,15 @@ parse_page(
 {
 	unsigned long long id;
 	uint16_t undo_page_type;
-	char str[20]={'\0'};
+	const char *str;
 	ulint n_recs;
 	uint32_t page_no, left_page_no, right_page_no;
 	ulint data_bytes;
 	bool is_leaf;
 	ulint size_range_id;
 
 	/* Check whether page is doublewrite buffer. */
-	if(skip_page) {
-		strcpy(str, "Double_write_buffer");
-	} else {
-		strcpy(str, "-");
-	}
+	str = skip_page ? "Double_write_buffer" : "-";
 
 	switch (mach_read_from_2(page + FIL_PAGE_TYPE)) {
 

extra/mariabackup/xbcloud.cc

@@ -1676,8 +1676,11 @@ container_list_add_object(container_list *list, const char *name,
 		list->object_count += object_count_step;
 	}
 	assert(list->idx <= list->object_count);
-	strcpy(list->objects[list->idx].name, name);
-	strcpy(list->objects[list->idx].hash, hash);
+	safe_strcpy(list->objects[list->idx].name,
+		    sizeof(list->objects[list->idx].name), name);
+	safe_strcpy(list->objects[list->idx].hash,
+		    sizeof(list->objects[list->idx].hash), hash);
+
 	list->objects[list->idx].bytes = bytes;
 	++list->idx;
 }

extra/mariabackup/xtrabackup.cc

@@ -4235,11 +4235,13 @@ static bool xtrabackup_backup_low()
 
 	dst_log_file = NULL;
 
-	if(!xtrabackup_incremental) {
-		strcpy(metadata_type, "full-backuped");
+	if (!xtrabackup_incremental) {
+		safe_strcpy(metadata_type, sizeof(metadata_type),
+			    "full-backuped");
 		metadata_from_lsn = 0;
 	} else {
-		strcpy(metadata_type, "incremental");
+		safe_strcpy(metadata_type, sizeof(metadata_type),
+			    "incremental");
 		metadata_from_lsn = incremental_lsn;
 	}
 	metadata_last_lsn = log_copy_scanned_lsn;
@@ -5987,7 +5989,8 @@ static bool xtrabackup_prepare_func(char** argv)
 	if (ok) {
 		char	filename[FN_REFLEN];
 
-		strcpy(metadata_type, "log-applied");
+		safe_strcpy(metadata_type, sizeof(metadata_type),
+			    "log-applied");
 
 		if(xtrabackup_incremental
 		   && metadata_to_lsn < incremental_to_lsn)

include/m_string.h

@@ -225,6 +225,44 @@ static inline void lex_string_set3(LEX_CSTRING *lex_str, const char *c_str,
   lex_str->length= len;
 }
 
+/*
+  Copies src into dst and ensures dst is a NULL terminated C string.
+
+  Returns 1 if the src string was truncated due to too small size of dst.
+  Returns 0 if src completely fit within dst. Pads the remaining dst with '\0'
+
+  Note: dst_size must be > 0
+*/
+static inline int safe_strcpy(char *dst, size_t dst_size, const char *src)
+{
+  memset(dst, '\0', dst_size);
+  strncpy(dst, src, dst_size - 1);
+  /*
+     If the first condition is true, we are guaranteed to have src length
+     >= (dst_size - 1), hence safe to access src[dst_size - 1].
+  */
+  if (dst[dst_size - 2] != '\0' && src[dst_size - 1] != '\0')
+    return 1; /* Truncation of src. */
+  return 0;
+}
+
+/*
+  Appends src to dst and ensures dst is a NULL terminated C string.
+
+  Returns 1 if the src string was truncated due to too small size of dst.
+  Returns 0 if src completely fit within the remaining dst space. Pads the
+            remaining dst with '\0'.
+
+  Note: dst_size must be > 0
+*/
+static inline int safe_strcat(char *dst, size_t dst_size, const char *src)
+{
+  size_t init_len= strlen(dst);
+  if (unlikely(init_len >= dst_size - 1))
+    return 1;
+  return safe_strcpy(dst + init_len, dst_size - init_len, src);
+}
+
 #ifdef __cplusplus
 static inline char *safe_str(char *str)
 { return str ? str : const_cast<char*>(""); }

sql/mysql_install_db.cc

@@ -243,7 +243,7 @@ static char *get_plugindir()
 {
   static char plugin_dir[2*MAX_PATH];
   get_basedir(plugin_dir, sizeof(plugin_dir), mysqld_path);
-  strcat(plugin_dir, "/" STR(INSTALL_PLUGINDIR));
+  safe_strcat(plugin_dir, sizeof(plugin_dir), "/" STR(INSTALL_PLUGINDIR));
 
   if (access(plugin_dir, 0) == 0)
     return plugin_dir;