CONC-429: Don't allow to load unknown authentication plugins

Check for incorrect symbols in the plugin name.
mariadb-corporation · Jul 25, 2019 · ed3a91c · ed3a91c
1 parent 59780f9
commit ed3a91c
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/libmariadb/ma_client_plugin.c.in b/libmariadb/ma_client_plugin.c.in
@@ -389,6 +389,13 @@ mysql_load_plugin_v(MYSQL *mysql, const char *name, int type,
            mysql->options.extension->plugin_dir : (env_plugin_dir) ? env_plugin_dir :
            MARIADB_PLUGINDIR, name, SO_EXT);
 
+  if (strpbrk(name, "()[]!@#$%^&/*;.,'?\\"))
+  {
+    errmsg= "invalid plugin name";
+    goto err;
+  }
+
+
   /* Open new dll handle */
   if (!(dlhandle= dlopen((const char *)dlpath, RTLD_NOW)))
   {