MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion
该报告还没有中文解读。
原文摘录
摘自原文（9738 字符中的一小部分）
`chain_size` counts elements of the 16-byte `tina_set` struct. On the first array growth the code takes the `my_malloc` path and correctly requests `chain_size * sizeof(tina_set)` bytes. On the second growth it takes the `my_realloc` path and requests `chain_size` bytes, a 16x under-allocation. The …
原文中的代码
if ((off_t)(chain_ptr - chain) == (chain_size -1)) // Line 642: chain_size is an element COUNT (pointer arithmetic)
{
my_off_t location= chain_ptr - chain;
chain_size += DEFAULT_CHAIN_LENGTH;
if (chain_alloced)
{
if ((chain= (tina_set *) …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 MariaDB 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @v3rtical · 版权归作者与 MariaDB 所有