MDEV-40571 insufficient validation of frm data when opening a table

mysql-test/main/lotofstack.result

@@ -108,4 +108,11 @@ SELECT ST_GeomFromText(CONCAT(REPEAT('GEOMETRYCOLLECTION(',5000),'POINT(1 1)',RE
 #
 set @a=concat(0x0107000000, repeat(0x010000000107000000, 120000), 0x00000000);
 SELECT ST_GeomFromWKB(@a);
+#
+# MDEV-39750 ExtractValue does not control recursion depth.
+#
+SELECT ExtractValue('<a/>', REPEAT('(', 100000));
+ERROR HY000: Thread stack overrun:  'used bytes' used of a 'available' byte stack, and 'X' bytes needed. Consider increasing the thread_stack system variable.
+SELECT ExtractValue('<a/>', REPEAT('/n', 100000));
+ERROR HY000: Thread stack overrun:  'used bytes' used of a 'available' byte stack, and 'X' bytes needed. Consider increasing the thread_stack system variable.
 # End of 10.6 tests

mysql-test/main/lotofstack.test

@@ -149,4 +149,15 @@ set @a=concat(0x0107000000, repeat(0x010000000107000000, 120000), 0x00000000);
 SELECT ST_GeomFromWKB(@a);
 --enable_result_log
 
+--echo #
+--echo # MDEV-39750 ExtractValue does not control recursion depth.
+--echo #
+--replace_regex /overrun:  [0-9]* bytes used of a [0-9]* byte stack, and [0-9]* bytes needed/overrun:  'used bytes' used of a 'available' byte stack, and 'X' bytes needed/
+--error ER_STACK_OVERRUN_NEED_MORE
+SELECT ExtractValue('<a/>', REPEAT('(', 100000));
+
+--replace_regex /overrun:  [0-9]* bytes used of a [0-9]* byte stack, and [0-9]* bytes needed/overrun:  'used bytes' used of a 'available' byte stack, and 'X' bytes needed/
+--error ER_STACK_OVERRUN_NEED_MORE
+SELECT ExtractValue('<a/>', REPEAT('/n', 100000));
+
 --echo # End of 10.6 tests

mysql-test/main/mysqld--help,win.rdiff

@@ -1,22 +1,32 @@
 --- a/mysql-test/main/mysqld--help.result
 +++ b/mysql-test/main/mysqld--help.result
-@@ -180,6 +180,7 @@ The following specify which files/extra groups are read (specified before remain
+@@ -190,6 +190,7 @@ The following specify which files/extra groups are read (specified before remain
   --console           Write error output on screen; don't remove the console
   window on windows.
   --core-file         Write core on crashes
 + (Defaults to on; use --skip-core-file to disable.)
   -h, --datadir=name  Path to the database root directory
   --date-format=name  The DATE format (ignored)
   --datetime-format=name 
-@@ -649,6 +650,7 @@ The following specify which files/extra groups are read (specified before remain
+@@ -677,6 +678,7 @@ The following specify which files/extra groups are read (specified before remain
   Use MySQL-5.6 (instead of MariaDB-5.3) format for TIME,
   DATETIME, TIMESTAMP columns.
   (Defaults to on; use --skip-mysql56-temporal-format to disable.)
 + --named-pipe        Enable the named pipe (NT)
   --net-buffer-length=# 
   Buffer length for TCP/IP and socket communication
   --net-read-timeout=# 
-@@ -1280,6 +1282,10 @@ The following specify which files/extra groups are read (specified before remain
+@@ -1192,8 +1194,7 @@ The following specify which files/extra groups are read (specified before remain
+  (Defaults to on; use --skip-secure-auth to disable.)
+  --secure-file-priv=name 
+  Limit LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE() to
+- files within specified directory. Empty value means no
+- limits except /proc
++ files within specified directory.
+  --secure-timestamp=name 
+  Restricts direct setting of a session timestamp. Possible
+  levels are: YES - timestamp cannot deviate from the
+@@ -1346,6 +1347,10 @@ The following specify which files/extra groups are read (specified before remain
   Log slow queries to given log file. Defaults logging to
   'hostname'-slow.log. Must be enabled to activate other
   slow log options
@@ -27,15 +37,15 @@
   --socket=name       Socket file to use for connection
   --sort-buffer-size=# 
   Each thread that needs to do a sort allocates a buffer of
-@@ -1304,6 +1310,7 @@ The following specify which files/extra groups are read (specified before remain
+@@ -1371,6 +1376,7 @@ The following specify which files/extra groups are read (specified before remain
   deleting or updating every row in a table.
   --stack-trace       Print a symbolic stack trace on failure
   (Defaults to on; use --skip-stack-trace to disable.)
 + --standalone        Dummy option to start as a standalone program (NT).
   --standard-compliant-cte 
   Allow only CTEs compliant to SQL standard
   (Defaults to on; use --skip-standard-compliant-cte to disable.)
-@@ -1379,6 +1386,12 @@ The following specify which files/extra groups are read (specified before remain
+@@ -1446,6 +1452,12 @@ The following specify which files/extra groups are read (specified before remain
   --thread-pool-max-threads=# 
   Maximum allowed number of worker threads in the thread
   pool
@@ -48,7 +58,7 @@
   --thread-pool-oversubscribe=# 
   How many additional active worker threads in a group are
   allowed.
-@@ -1417,8 +1430,8 @@ The following specify which files/extra groups are read (specified before remain
+@@ -1485,8 +1497,8 @@ The following specify which files/extra groups are read (specified before remain
   automatically convert it to an on-disk MyISAM or Aria
   table.
   -t, --tmpdir=name   Path for temporary files. Several paths may be specified,
@@ -59,23 +69,23 @@
   --transaction-alloc-block-size=# 
   Allocation block size for transactions to be stored in
   binary log
-@@ -1633,6 +1646,7 @@ myisam-sort-buffer-size 134216704
+@@ -1704,6 +1716,7 @@ myisam-sort-buffer-size 134216704
  myisam-stats-method NULLS_UNEQUAL
  myisam-use-mmap FALSE
  mysql56-temporal-format TRUE
 +named-pipe FALSE
  net-buffer-length 16384
  net-read-timeout 30
  net-retry-count 10
-@@ -1787,6 +1801,7 @@ slave-transaction-retry-interval 0
+@@ -1862,6 +1875,7 @@ slave-transaction-retry-interval 0
  slave-type-conversions 
  slow-launch-time 2
  slow-query-log FALSE
 +slow-start-timeout 15000
  sort-buffer-size 2097152
  sql-mode STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
  sql-safe-updates FALSE
-@@ -1813,6 +1828,8 @@ thread-pool-dedicated-listener FALSE
+@@ -1888,6 +1902,8 @@ thread-pool-dedicated-listener FALSE
  thread-pool-exact-stats FALSE
  thread-pool-idle-timeout 60
  thread-pool-max-threads 65536

mysql-test/main/mysqld--help.result

@@ -1192,7 +1192,8 @@ The following specify which files/extra groups are read (specified before remain
  (Defaults to on; use --skip-secure-auth to disable.)
  --secure-file-priv=name 
  Limit LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE() to
- files within specified directory
+ files within specified directory. Empty value means no
+ limits except /proc
  --secure-timestamp=name 
  Restricts direct setting of a session timestamp. Possible
  levels are: YES - timestamp cannot deviate from the

mysql-test/main/xml.result

@@ -1414,11 +1414,4 @@ ExtractValue(@xml, '/employee/dt3')
 NULL
 Warnings:
 Warning	1525	Incorrect XML value: 'parse error at line 10 pos 27: unexpected END-OF-INPUT'
-#
-# MDEV-39750 ExtractValue does not control recursion depth.
-#
-SELECT ExtractValue('<a/>', REPEAT('(', 100000));
-ERROR HY000: Thread stack overrun:  'used bytes' used of a 'available' byte stack, and 'X' bytes needed. Consider increasing the thread_stack system variable.
-SELECT ExtractValue('<a/>', REPEAT('/n', 100000));
-ERROR HY000: Thread stack overrun:  'used bytes' used of a 'available' byte stack, and 'X' bytes needed. Consider increasing the thread_stack system variable.
 # End of 10.6 tests

mysql-test/main/xml.test

@@ -899,17 +899,5 @@ set @xml= '<?xml version="1.0"?>
 
 SELECT ExtractValue(@xml, '/employee/dt3');
 
---echo #
---echo # MDEV-39750 ExtractValue does not control recursion depth.
---echo #
-
---replace_regex /overrun:  [0-9]* bytes used of a [0-9]* byte stack, and [0-9]* bytes needed/overrun:  'used bytes' used of a 'available' byte stack, and 'X' bytes needed/
---error ER_STACK_OVERRUN_NEED_MORE
-SELECT ExtractValue('<a/>', REPEAT('(', 100000));
-
---replace_regex /overrun:  [0-9]* bytes used of a [0-9]* byte stack, and [0-9]* bytes needed/overrun:  'used bytes' used of a 'available' byte stack, and 'X' bytes needed/
---error ER_STACK_OVERRUN_NEED_MORE
-SELECT ExtractValue('<a/>', REPEAT('/n', 100000));
-
 --echo # End of 10.6 tests
 

mysql-test/suite/sys_vars/r/secure_file_priv.result

@@ -6,14 +6,17 @@ INSERT INTO t1 VALUES ("one"),("two"),("three"),("four"),("five");
 SHOW VARIABLES LIKE 'secure_file_priv';
 Variable_name	Value
 secure_file_priv	
-Warnings:
-Warning	1287	'<select expression> INTO <destination>;' is deprecated and will be removed in a future release. Please use 'SELECT <select list> INTO <destination> FROM...' instead
+SELECT * INTO OUTFILE '$MYSQLTEST_VARDIR/../bug50373.txt' FROM t1;
+DELETE FROM t1;
+LOAD DATA INFILE '$MYSQLTEST_VARDIR/../bug50373.txt' INTO TABLE t1;
+SELECT * FROM t1;
 c1
 one
 two
 three
 four
 five
+SELECT load_file('$MYSQLTEST_VARDIR/../bug50373.txt') AS loaded_file;
 loaded_file
 one
 two
@@ -22,3 +25,11 @@ four
 five
 
 DROP TABLE t1;
+#
+# MDEV-40589 default exclude list for secure-file-priv
+#
+CREATE TABLE t1 (c1 VARCHAR(50));
+LOAD DATA INFILE '/proc/cpuinfo' INTO TABLE t1;
+ERROR HY000: The MariaDB server is running with the --secure-file-priv option so it cannot execute this statement
+DROP TABLE t1;
+# End of 10.6 tests

mysql-test/suite/sys_vars/r/sysvars_server_embedded.result

@@ -3115,7 +3115,7 @@ COMMAND_LINE_ARGUMENT	OPTIONAL
 VARIABLE_NAME	SECURE_FILE_PRIV
 VARIABLE_SCOPE	GLOBAL
 VARIABLE_TYPE	VARCHAR
-VARIABLE_COMMENT	Limit LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE() to files within specified directory
+VARIABLE_COMMENT	Limit LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE() to files within specified directory. Empty value means no limits except /proc
 NUMERIC_MIN_VALUE	NULL
 NUMERIC_MAX_VALUE	NULL
 NUMERIC_BLOCK_SIZE	NULL

mysql-test/suite/sys_vars/r/sysvars_server_notembedded.result

@@ -3565,7 +3565,7 @@ COMMAND_LINE_ARGUMENT	OPTIONAL
 VARIABLE_NAME	SECURE_FILE_PRIV
 VARIABLE_SCOPE	GLOBAL
 VARIABLE_TYPE	VARCHAR
-VARIABLE_COMMENT	Limit LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE() to files within specified directory
+VARIABLE_COMMENT	Limit LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE() to files within specified directory. Empty value means no limits except /proc
 NUMERIC_MIN_VALUE	NULL
 NUMERIC_MAX_VALUE	NULL
 NUMERIC_BLOCK_SIZE	NULL

mysql-test/suite/sys_vars/t/secure_file_priv.test

@@ -4,7 +4,6 @@
 CREATE TABLE t1 (c1 VARCHAR(50));
 INSERT INTO t1 VALUES ("one"),("two"),("three"),("four"),("five");
 SHOW VARIABLES LIKE 'secure_file_priv';
---disable_query_log
 
 # Atempt to create a file where we normally aren't allowed to create one.
 #
@@ -17,37 +16,26 @@ SHOW VARIABLES LIKE 'secure_file_priv';
 # If we run tests with --mem, it will be /dev/shm.
 # If we run tests with --parallel, it will be mysql-test/var
 # (because MYSQLTEST_VARDIR in this case is mysql-test/var/N).
---disable_cursor_protocol
-
---perl
-use File::Basename;
-my $protected_file= dirname($ENV{MYSQLTEST_VARDIR}).'/bug50373.txt';
-# Ensure bug50373.txt does not exist (e.g. leftover from previous
-# test runs).
-unlink $protected_file;
-open(FILE, ">", "$ENV{MYSQL_TMP_DIR}/bug50373.inc") or die;
-print FILE "--disable_ps2_protocol\n";
-print FILE "SELECT * FROM t1 INTO OUTFILE '".$protected_file."';\n";
-print FILE "--enable_ps2_protocol\n";
-print FILE "DELETE FROM t1;\n";
-print FILE "LOAD DATA INFILE '".$protected_file."' INTO TABLE t1;\n";
-print FILE "SELECT * FROM t1;\n";
-print FILE "SELECT load_file('",$protected_file,"') AS loaded_file;\n";
-close(FILE);
-EOF
-
---enable_prepare_warnings
---source $MYSQL_TMP_DIR/bug50373.inc
---disable_prepare_warnings
---remove_file $MYSQL_TMP_DIR/bug50373.inc
---enable_query_log
 
+--disable_cursor_protocol
+--disable_ps2_protocol
+evalp SELECT * INTO OUTFILE '$MYSQLTEST_VARDIR/../bug50373.txt' FROM t1;
+--enable_ps2_protocol
 --enable_cursor_protocol
-
+DELETE FROM t1;
+evalp LOAD DATA INFILE '$MYSQLTEST_VARDIR/../bug50373.txt' INTO TABLE t1;
+SELECT * FROM t1;
+evalp SELECT load_file('$MYSQLTEST_VARDIR/../bug50373.txt') AS loaded_file;
 DROP TABLE t1;
 
---perl
-use File::Basename;
-unlink dirname($ENV{MYSQLTEST_VARDIR}).'/bug50373.txt';
-EOF
+--remove_file $MYSQLTEST_VARDIR/../bug50373.txt
+
+--echo #
+--echo # MDEV-40589 default exclude list for secure-file-priv
+--echo #
+CREATE TABLE t1 (c1 VARCHAR(50));
+--error ER_OPTION_PREVENTS_STATEMENT
+LOAD DATA INFILE '/proc/cpuinfo' INTO TABLE t1;
+DROP TABLE t1;
 
+--echo # End of 10.6 tests

sql/mysqld.cc

@@ -8860,45 +8860,39 @@ fn_format_relative_to_data_home(char * to, const char *name,
 
 bool is_secure_file_path(char *path)
 {
-  char buff1[FN_REFLEN], buff2[FN_REFLEN];
-  size_t opt_secure_file_priv_len;
-  /*
-    All paths are secure if opt_secure_file_path is 0
-  */
-  if (!opt_secure_file_priv)
-    return TRUE;
+  char buf1[FN_REFLEN], buf2[FN_REFLEN];
+  const char *cmp;
 
-  opt_secure_file_priv_len= strlen(opt_secure_file_priv);
+  if (opt_secure_file_priv)
+    cmp= opt_secure_file_priv;
+  else
+#ifdef _WIN32
+    return TRUE;     // All paths are secure if opt_secure_file_priv is unset
+#else
+    cmp= "/proc/";   // Check that it doesn't start with this prefix
+#endif
 
   if (strlen(path) >= FN_REFLEN)
     return FALSE;
 
-  if (my_realpath(buff1, path, 0))
-  {
-    /*
-      The supplied file path might have been a file and not a directory.
-    */
-    size_t length= dirname_length(path);        // Guaranteed to be < FN_REFLEN
-    memcpy(buff2, path, length);
-    buff2[length]= '\0';
-    if (length == 0 || my_realpath(buff1, buff2, 0))
-      return FALSE;
-  }
-  convert_dirname(buff2, buff1, NullS);
-  if (!lower_case_file_system)
+  if (my_realpath(buf1, path, 0))
   {
-    if (strncmp(opt_secure_file_priv, buff2, opt_secure_file_priv_len))
+    /* The supplied file path might have been a file and not a directory. */
+    size_t length= dirname_length(path);      // Guaranteed to be < FN_REFLEN
+    memcpy(buf2, path, length);
+    buf2[length]= '\0';
+    if (length == 0 || my_realpath(buf1, buf2, 0))
       return FALSE;
   }
+  convert_dirname(buf2, buf1, NullS);
+
+  size_t cmp_len= strlen(cmp);
+  bool matched;
+  if (lower_case_file_system)
+    matched= !files_charset_info->strnncoll(buf2, strlen(buf2), cmp, cmp_len, 1);
   else
-  {
-    if (files_charset_info->strnncoll(buff2, strlen(buff2),
-                                      opt_secure_file_priv,
-                                      opt_secure_file_priv_len,
-                                      TRUE))
-      return FALSE;
-  }
-  return TRUE;
+    matched= !strncmp(cmp, buf2, cmp_len);
+  return opt_secure_file_priv ? matched : !matched;
 }
 
 

sql/sys_vars.cc

@@ -3357,11 +3357,15 @@ static Sys_var_mybool Sys_require_secure_transport(
   ON_CHECK(check_require_secure_transport), ON_UPDATE(0));
 
 static Sys_var_charptr_fscs Sys_secure_file_priv(
-       "secure_file_priv",
-       "Limit LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE() to files "
-       "within specified directory",
-       PREALLOCATED READ_ONLY GLOBAL_VAR(opt_secure_file_priv),
-       CMD_LINE(REQUIRED_ARG), DEFAULT(0));
+  "secure_file_priv",
+  "Limit LOAD DATA, SELECT ... OUTFILE, and LOAD_FILE() to files "
+  "within specified directory."
+#ifndef _WIN32
+  " Empty value means no limits except /proc"
+#endif
+  ,
+  PREALLOCATED READ_ONLY GLOBAL_VAR(opt_secure_file_priv),
+  CMD_LINE(REQUIRED_ARG), DEFAULT(0));
 
 static bool check_server_id(sys_var *self, THD *thd, set_var *var)
 {