patches/source/mysql/mysql.CVE-2014-0001.diff


1
2
3
4
5
6
7
8
9
10
11

--- ./client/mysql.cc.orig	2013-11-04 12:52:27.000000000 -0600
+++ ./client/mysql.cc	2014-02-18 22:24:32.928195436 -0600
@@ -1167,7 +1167,7 @@
 
   put_info("Welcome to the MySQL monitor.  Commands end with ; or \\g.",
 	   INFO_INFO);
-  sprintf((char*) glob_buffer.ptr(),
+  snprintf((char*) glob_buffer.ptr(), glob_buffer.alloced_length(),
 	  "Your MySQL connection id is %lu\nServer version: %s\n",
 	  mysql_thread_id(&mysql), server_version_string(&mysql));
   put_info((char*) glob_buffer.ptr(),INFO_INFO);