Bug#22958632 ASAN: NAME_CONST WITH INVALID IDENTIFIER, HEAP-BUFFER-OVERFLOW

Tor Didriksen · Tor Didriksen · commit 5f3490aea8c0 · 2025-01-20T14:29:06.000+01:00
The function append_identifier() might receive bad input, e.g. strings
that are not valid according to the given charset/collation. Ensure
that it simply quotes the input, and never reads past-the-end of it.

Change-Id: I7720678b78879ab768dbe50b0c03c9591cd437f8
(cherry picked from commit c72537c3718f5693174753bb62c97d833ddc2362)
(cherry picked from commit 530dd2acd9c0884ee3d50af879a9baeb4cf0ac0c)
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
@@ -1565,7 +1565,9 @@ void append_identifier(const THD *thd, String *packet, const char *name,
     if (!to_length) to_length = 1;
     if (to_length == 1 && chr == static_cast<uchar>(quote_char))
       packet->append(&quote_char, 1, system_charset_info);
-    packet->append(to_name, to_length, system_charset_info);
+    packet->append(to_name,
+                   std::min(to_length, static_cast<size_t>(name_end - to_name)),
+                   system_charset_info);
   }
   packet->append(&quote_char, 1, system_charset_info);
 }

Original file line number	Diff line number	Diff line change
`@@ -1565,7 +1565,9 @@ void append_identifier(const THD thd, String packet, const char *name,`
`1565`	`1565`	`if (!to_length) to_length = 1;`
`1566`	`1566`	`if (to_length == 1 && chr == static_cast<uchar>(quote_char))`
`1567`	`1567`	`packet->append(&quote_char, 1, system_charset_info);`
`1568`		`- packet->append(to_name, to_length, system_charset_info);`
	`1568`	`+ packet->append(to_name,`
	`1569`	`+ std::min(to_length, static_cast<size_t>(name_end - to_name)),`
	`1570`	`+ system_charset_info);`
`1569`	`1571`	`}`
`1570`	`1572`	`packet->append(&quote_char, 1, system_charset_info);`
`1571`	`1573`	`}`