11/*
2- Copyright (c) 2005, 2012, Oracle and/or its affiliates.
2+ Copyright (c) 2005, 2015, Oracle and/or its affiliates.
3+ Copyright (c) 2010, 2015, MariaDB
34
45 This program is free software; you can redistribute it and/or modify
56 it under the terms of the GNU General Public License as published by
@@ -242,7 +243,7 @@ void print_conclusions_csv(conclusions *con);
242243void generate_stats (conclusions * con , option_string * eng , stats * sptr );
243244uint parse_comma (const char * string , uint * * range );
244245uint parse_delimiter (const char * script , statement * * stmt , char delm );
245- uint parse_option (const char * origin , option_string * * stmt , char delm );
246+ int parse_option (const char * origin , option_string * * stmt , char delm );
246247static int drop_schema (MYSQL * mysql , const char * db );
247248uint get_random_string (char * buf );
248249static statement * build_table_string (void );
@@ -1264,7 +1265,13 @@ get_options(int *argc,char ***argv)
12641265 if (num_int_cols_opt )
12651266 {
12661267 option_string * str ;
1267- parse_option (num_int_cols_opt , & str , ',' );
1268+ if (parse_option (num_int_cols_opt , & str , ',' ) == -1 )
1269+ {
1270+ fprintf (stderr , "Invalid value specified for the option "
1271+ "'number-int-cols'\n" );
1272+ option_cleanup (str );
1273+ return 1 ;
1274+ }
12681275 num_int_cols = atoi (str -> string );
12691276 if (str -> option )
12701277 num_int_cols_index = atoi (str -> option );
@@ -1275,7 +1282,13 @@ get_options(int *argc,char ***argv)
12751282 if (num_char_cols_opt )
12761283 {
12771284 option_string * str ;
1278- parse_option (num_char_cols_opt , & str , ',' );
1285+ if (parse_option (num_char_cols_opt , & str , ',' ) == -1 )
1286+ {
1287+ fprintf (stderr , "Invalid value specified for the option "
1288+ "'number-char-cols'\n" );
1289+ option_cleanup (str );
1290+ return 1 ;
1291+ }
12791292 num_char_cols = atoi (str -> string );
12801293 if (str -> option )
12811294 num_char_cols_index = atoi (str -> option );
@@ -1512,7 +1525,13 @@ get_options(int *argc,char ***argv)
15121525 printf ("Parsing engines to use.\n" );
15131526
15141527 if (default_engine )
1515- parse_option (default_engine , & engine_options , ',' );
1528+ {
1529+ if (parse_option (default_engine , & engine_options , ',' ) == -1 )
1530+ {
1531+ fprintf (stderr , "Invalid value specified for the option 'engine'\n" );
1532+ return 1 ;
1533+ }
1534+ }
15161535
15171536 if (tty_password )
15181537 opt_password = get_tty_password (NullS );
@@ -1989,7 +2008,7 @@ pthread_handler_t run_task(void *p)
19892008 DBUG_RETURN (0 );
19902009}
19912010
1992- uint
2011+ int
19932012parse_option (const char * origin , option_string * * stmt , char delm )
19942013{
19952014 char * retstr ;
@@ -2014,6 +2033,13 @@ parse_option(const char *origin, option_string **stmt, char delm)
20142033 char buffer [HUGE_STRING_LENGTH ]= "" ;
20152034 char * buffer_ptr ;
20162035
2036+ /*
2037+ Return an error if the length of the any of the comma seprated value
2038+ exceeds HUGE_STRING_LENGTH.
2039+ */
2040+ if ((size_t )(retstr - ptr ) > HUGE_STRING_LENGTH )
2041+ return -1 ;
2042+
20172043 count ++ ;
20182044 strncpy (buffer , ptr , (size_t )(retstr - ptr ));
20192045 /*
@@ -2053,6 +2079,13 @@ parse_option(const char *origin, option_string **stmt, char delm)
20532079 {
20542080 char * origin_ptr ;
20552081
2082+ /*
2083+ Return an error if the length of the any of the comma seprated value
2084+ exceeds HUGE_STRING_LENGTH.
2085+ */
2086+ if (strlen (ptr ) > HUGE_STRING_LENGTH )
2087+ return -1 ;
2088+
20562089 if ((origin_ptr = strchr (ptr , ':' )))
20572090 {
20582091 char * option_ptr ;
@@ -2063,13 +2096,13 @@ parse_option(const char *origin, option_string **stmt, char delm)
20632096 option_ptr = (char * )ptr + 1 + tmp -> length ;
20642097
20652098 /* Move past the : and the first string */
2066- tmp -> option_length = ( size_t )(( ptr + length ) - option_ptr );
2099+ tmp -> option_length = strlen ( option_ptr );
20672100 tmp -> option = my_strndup (option_ptr , tmp -> option_length ,
20682101 MYF (MY_FAE ));
20692102 }
20702103 else
20712104 {
2072- tmp -> length = ( size_t )(( ptr + length ) - ptr );
2105+ tmp -> length = strlen ( ptr );
20732106 tmp -> string = my_strndup (ptr , tmp -> length , MYF (MY_FAE ));
20742107 }
20752108
0 commit comments