From a2e5235b927deedc1decdf655c8283b19adc9069 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 21 May 2006 16:10:28 +0000 Subject: Fixed a possible buffer overflow inside create_named_pipe() for Win32 systems in libmysql.c. --- ext/mysql/libmysql/libmysql.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'ext/mysql/libmysql/libmysql.c') diff --git a/ext/mysql/libmysql/libmysql.c b/ext/mysql/libmysql/libmysql.c index 94d6352252..a1f7a4520c 100644 --- a/ext/mysql/libmysql/libmysql.c +++ b/ext/mysql/libmysql/libmysql.c @@ -213,6 +213,10 @@ HANDLE create_named_pipe(NET *net, uint connect_timeout, char **arg_host, if (!host || !strcmp(host,LOCAL_HOST)) host=LOCAL_HOST_NAMEDPIPE; + if (sizeof(szPipeName) <= (strlen(host) + strlen(unix_socket) + sizeof("\\\\\\pipe\\"))) { + return INVALID_HANDLE_VALUE; + } + sprintf( szPipeName, "\\\\%s\\pipe\\%s", host, unix_socket); DBUG_PRINT("info",("Server name: '%s'. Named Pipe: %s", host, unix_socket)); -- cgit v1.2.1