Attachment #90548 for bug #127731

View | Details | Raw Unified | Return to bug 127731
Collapse All | Expand All

Lines 7-13 Link Here

(-)mysql41-server/Makefile (-1 / +1 lines)
7		7
8	PORTNAME?= mysql	8	PORTNAME?= mysql
9	PORTVERSION= 4.1.22	9	PORTVERSION= 4.1.22
10	PORTREVISION?= 0	10	PORTREVISION?= 1
11	CATEGORIES= databases	11	CATEGORIES= databases
12	MASTER_SITES= ${MASTER_SITE_MYSQL}	12	MASTER_SITES= ${MASTER_SITE_MYSQL}
13	MASTER_SITE_SUBDIR= MySQL-4.1	13	MASTER_SITE_SUBDIR= MySQL-4.1




--- mysql-test/r/symlink.result	2006-06-27 17:22:43 +0000
+++ mysql-test/r/symlink.result	2008-02-29 12:56:41 +0000
@@ -90,15 +90,62 @@
   `b` int(11) default NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 drop table t1;
-show create table t1;
-Table	Create Table
-t1	CREATE TABLE `t1` (
-  `i` int(11) default NULL
-) ENGINE=MyISAM DEFAULT CHARSET=latin1
-drop table t1;
-show create table t1;
-Table	Create Table
-t1	CREATE TABLE `t1` (
-  `i` int(11) default NULL
-) ENGINE=MyISAM DEFAULT CHARSET=latin1
-drop table t1;
+CREATE TABLE t1(a INT)
+DATA DIRECTORY='TEST_DIR/tmp'
+INDEX DIRECTORY='TEST_DIR/tmp';
+ERROR HY000: Can't create/write to file 'TEST_DIR/tmp/t1.MYI' (Errcode: 17)
+CREATE TABLE t2(a INT)
+DATA DIRECTORY='TEST_DIR/tmp'
+INDEX DIRECTORY='TEST_DIR/tmp';
+RENAME TABLE t2 TO t1;
+ERROR HY000: Can't create/write to file 'TEST_DIR/tmp/t1.MYI' (Errcode: 17)
+DROP TABLE t2;
+show create table t1;
+Table	Create Table
+t1	CREATE TEMPORARY TABLE `t1` (
+  `a` int(11) default NULL
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 DATA DIRECTORY='MYSQL_TEST_DIR/var/log/'
+show create table t1;
+Table	Create Table
+t1	CREATE TEMPORARY TABLE `t1` (
+  `a` int(11) default NULL
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 DATA DIRECTORY='MYSQL_TEST_DIR/var/log/'
+create table t1 (a int) engine=myisam select 42 a;
+select * from t1;
+a
+9
+select * from t1;
+a
+99
+select * from t1;
+a
+42
+drop table t1;
+execute stmt;
+show create table t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `c` char(10) default NULL
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 DATA DIRECTORY='MYSQLTEST_VARDIR/tmp/'
+drop table t1;
+execute stmt;
+show create table t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `c` char(10) default NULL
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 DATA DIRECTORY='MYSQLTEST_VARDIR/tmp/'
+drop table t1;
+deallocate prepare stmt;
+CREATE TABLE t1(a INT)
+DATA DIRECTORY='TEST_DIR/var/master-data/test';
+ERROR HY000: Incorrect arguments to DATA DIRECORY
+CREATE TABLE t1(a INT)
+DATA DIRECTORY='TEST_DIR/var/master-data/';
+ERROR HY000: Incorrect arguments to DATA DIRECORY
+CREATE TABLE t1(a INT)
+INDEX DIRECTORY='TEST_DIR/var/master-data';
+ERROR HY000: Incorrect arguments to INDEX DIRECORY
+CREATE TABLE t1(a INT)
+INDEX DIRECTORY='TEST_DIR/var/master-data_var';
+ERROR HY000: Can't create/write to file 'TEST_DIR/var/master-data_var/t1.MYI' (Errcode: 2)
+End of 4.1 tests





--- mysql-test/t/symlink.test	2005-12-08 15:13:53 +0000
+++ mysql-test/t/symlink.test	2008-02-29 12:56:41 +0000
@@ -119,18 +119,99 @@
 drop table t1;
 
 #
-# Test specifying DATA DIRECTORY that is the same as what would normally
-# have been chosen. (Bug #8707)
-#
-disable_query_log;
-eval create table t1 (i int) data directory = "$MYSQL_TEST_DIR/var/master-data/test/";
-enable_query_log;
-show create table t1;
-drop table t1;
-disable_query_log;
-eval create table t1 (i int) index directory = "$MYSQL_TEST_DIR/var/master-data/test/";
-enable_query_log;
-show create table t1;
-drop table t1;
-
-# End of 4.1 tests
+# BUG#32111 - Security Breach via DATA/INDEX DIRECORY and RENAME TABLE
+#
+--write_file $MYSQLTEST_VARDIR/tmp/t1.MYI
+EOF
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1
+eval CREATE TABLE t1(a INT)
+DATA DIRECTORY='$MYSQLTEST_VARDIR/tmp'
+INDEX DIRECTORY='$MYSQLTEST_VARDIR/tmp';
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+eval CREATE TABLE t2(a INT)
+DATA DIRECTORY='$MYSQLTEST_VARDIR/tmp'
+INDEX DIRECTORY='$MYSQLTEST_VARDIR/tmp';
+--replace_result $MYSQLTEST_VARDIR TEST_DIR
+--error 1
+RENAME TABLE t2 TO t1;
+DROP TABLE t2;
+--remove_file $MYSQLTEST_VARDIR/tmp/t1.MYI
+
+#
+# Bug#8706 - temporary table with data directory option fails
+#
+connect (session1,localhost,root,,);
+connect (session2,localhost,root,,);
+
+connection session1;
+disable_query_log;
+eval create temporary table t1 (a int) engine=myisam data directory="$MYSQL_TEST_DIR/var/log" select 9 a;
+enable_query_log;
+# If running test suite with a non standard tmp dir, the "show create table"
+# will print "DATA_DIRECTORY=". Use replace_result to mask it out
+--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
+show create table t1;
+
+connection session2;
+disable_query_log;
+eval create temporary table t1 (a int) engine=myisam data directory="$MYSQL_TEST_DIR/var/log" select 99 a;
+enable_query_log;
+# If running test suite with a non standard tmp dir, the "show create table"
+# will print "DATA_DIRECTORY=". Use replace_result to mask it out
+--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
+show create table t1;
+
+connection default;
+create table t1 (a int) engine=myisam select 42 a;
+
+connection session1;
+select * from t1;
+disconnect session1;
+connection session2;
+select * from t1;
+disconnect session2;
+connection default;
+select * from t1;
+drop table t1;
+
+#
+# CREATE TABLE with DATA DIRECTORY option
+#
+# Protect ourselves from data left in tmp/ by a previos possibly failed
+# test
+--system rm -f $MYSQLTEST_VARDIR/tmp/t1.*
+--disable_query_log
+eval prepare stmt from "create table t1 (c char(10)) data directory='$MYSQLTEST_VARDIR/tmp'";
+--enable_query_log
+execute stmt;
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+show create table t1;
+drop table t1;
+execute stmt;
+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
+show create table t1;
+drop table t1;
+deallocate prepare stmt;
+
+#
+# Bug#32167 another privilege bypass with DATA/INDEX DIRECORY
+#
+--replace_result $MYSQL_TEST_DIR TEST_DIR
+--error 1210
+eval CREATE TABLE t1(a INT)
+DATA DIRECTORY='$MYSQL_TEST_DIR/var/master-data/test';
+--replace_result $MYSQL_TEST_DIR TEST_DIR
+--error 1210
+eval CREATE TABLE t1(a INT)
+DATA DIRECTORY='$MYSQL_TEST_DIR/var/master-data/';
+--replace_result $MYSQL_TEST_DIR TEST_DIR
+--error 1210
+eval CREATE TABLE t1(a INT)
+INDEX DIRECTORY='$MYSQL_TEST_DIR/var/master-data';
+--replace_result $MYSQL_TEST_DIR TEST_DIR
+--error 1
+eval CREATE TABLE t1(a INT)
+INDEX DIRECTORY='$MYSQL_TEST_DIR/var/master-data_var';
+
+--echo End of 4.1 tests


Line 0 Link Here

(-)mysql41-server/files/patch-sql::mysql_priv.h (+11 lines)
	1	--- sql/mysql_priv.h 2007-11-09 12:05:01 +0000
	2	+++ sql/mysql_priv.h 2008-02-29 09:55:00 +0000
	3	@@ -890,6 +890,7 @@
	4	extern time_t start_time;
	5	extern char *mysql_data_home,server_version[SERVER_VERSION_LENGTH],
	6	mysql_real_data_home[], *opt_mysql_tmpdir, mysql_charsets_dir[],
	7	+ mysql_unpacked_real_data_home[],
	8	def_ft_boolean_syntax[sizeof(ft_boolean_syntax)];
	9	#define mysql_tmpdir (my_tmpdir(&mysql_tmpdir_list))
	10	extern MY_TMPDIR mysql_tmpdir_list;
	11




 #include <syslog.h>
 #ifdef NEED_SYS_SYSLOG_H
 #include <sys/syslog.h>
--- sql/mysqld.cc	2007-11-29 10:52:36 +0000
+++ sql/mysqld.cc	2008-02-29 09:55:00 +0000
@@ -390,6 +390,7 @@
 char compiled_default_collation_name[]= MYSQL_DEFAULT_COLLATION_NAME;
 char *language_ptr, *default_collation_name, *default_character_set_name;
 char mysql_data_home_buff[2], *mysql_data_home=mysql_real_data_home;
+char mysql_unpacked_real_data_home[FN_REFLEN];
 struct passwd *user_info;
 char server_version[SERVER_VERSION_LENGTH];
 char *mysqld_unix_port, *opt_mysql_tmpdir;
@@ -6896,6 +6897,9 @@
     pos[1]= 0;
   }
   convert_dirname(mysql_real_data_home,mysql_real_data_home,NullS);
+  (void) fn_format(buff, mysql_real_data_home, "", "",
+                   (MY_RETURN_REAL_PATH|MY_RESOLVE_SYMLINKS));
+  (void) unpack_dirname(mysql_unpacked_real_data_home, buff);
   convert_dirname(language,language,NullS);
   (void) my_load_path(mysql_home,mysql_home,""); // Resolve current dir
   (void) my_load_path(mysql_real_data_home,mysql_real_data_home,mysql_home);





--- sql/sql_parse.cc	2007-06-12 12:47:36 +0000
+++ sql/sql_parse.cc	2008-02-29 09:55:00 +0000
@@ -65,7 +65,8 @@
 			       const char *table_name);
              
 static TABLE_LIST* get_table_by_alias(TABLE_LIST* tl, const char* db,
-  const char* alias);      
+  const char* alias);
+static bool test_if_data_home_dir(const char *dir);
 
 const char *any_db="*any*";	// Special symbol for check_access
 
@@ -2531,6 +2532,20 @@
                    "INDEX DIRECTORY option ignored");
     create_info.data_file_name= create_info.index_file_name= NULL;
 #else
+
+    if (test_if_data_home_dir(lex->create_info.data_file_name))
+    {
+      my_error(ER_WRONG_ARGUMENTS,MYF(0),"DATA DIRECORY");
+      res= -1;
+      break;
+    }
+    if (test_if_data_home_dir(lex->create_info.index_file_name))
+    {
+      my_error(ER_WRONG_ARGUMENTS,MYF(0),"INDEX DIRECORY");
+      res= -1;
+      break;
+    }
+
     /* Fix names if symlinked tables */
     if (append_file_to_dir(thd, &create_info.data_file_name,
 			   create_table->real_name) ||
@@ -5920,3 +5935,47 @@
     return negated;
   return new Item_func_not(expr);
 }
+
+
+/*
+  Check if path does not contain mysql data home directory
+
+  SYNOPSIS
+    test_if_data_home_dir()
+    dir                     directory
+    conv_home_dir           converted data home directory
+    home_dir_len            converted data home directory length
+
+  RETURN VALUES
+    0	ok
+    1	error  
+*/
+
+static bool test_if_data_home_dir(const char *dir)
+{
+  char path[FN_REFLEN], conv_path[FN_REFLEN];
+  uint dir_len, home_dir_len= strlen(mysql_unpacked_real_data_home);
+  DBUG_ENTER("test_if_data_home_dir");
+
+  if (!dir)
+    DBUG_RETURN(0);
+
+  (void) fn_format(path, dir, "", "",
+                   (MY_RETURN_REAL_PATH|MY_RESOLVE_SYMLINKS));
+  dir_len= unpack_dirname(conv_path, dir);
+
+  if (home_dir_len <= dir_len)
+  {
+    if (lower_case_file_system)
+    {
+      if (!my_strnncoll(default_charset_info, (const uchar*) conv_path,
+                        home_dir_len,
+                        (const uchar*) mysql_unpacked_real_data_home,
+                        home_dir_len))
+        DBUG_RETURN(1);
+    }
+    else if (!memcmp(conv_path, mysql_unpacked_real_data_home, home_dir_len))
+      DBUG_RETURN(1);
+  }
+  DBUG_RETURN(0);
+}


Return to bug 127731

Line 0 Link Here

(-)mysql41-server/files/patch-mysql-test::r::symlink.result (+78 lines)
		1	--- mysql-test/r/symlink.result 2006-06-27 17:22:43 +0000
		2	+++ mysql-test/r/symlink.result 2008-02-29 12:56:41 +0000
		3	@@ -90,15 +90,62 @@
		4	`b` int(11) default NULL
		5	) ENGINE=MyISAM DEFAULT CHARSET=latin1
		6	drop table t1;
		7	-show create table t1;
		8	-Table Create Table
		9	-t1 CREATE TABLE `t1` (
		10	- `i` int(11) default NULL
		11	-) ENGINE=MyISAM DEFAULT CHARSET=latin1
		12	-drop table t1;
		13	-show create table t1;
		14	-Table Create Table
		15	-t1 CREATE TABLE `t1` (
		16	- `i` int(11) default NULL
		17	-) ENGINE=MyISAM DEFAULT CHARSET=latin1
		18	-drop table t1;
		19	+CREATE TABLE t1(a INT)
		20	+DATA DIRECTORY='TEST_DIR/tmp'
		21	+INDEX DIRECTORY='TEST_DIR/tmp';
		22	+ERROR HY000: Can't create/write to file 'TEST_DIR/tmp/t1.MYI' (Errcode: 17)
		23	+CREATE TABLE t2(a INT)
		24	+DATA DIRECTORY='TEST_DIR/tmp'
		25	+INDEX DIRECTORY='TEST_DIR/tmp';
		26	+RENAME TABLE t2 TO t1;
		27	+ERROR HY000: Can't create/write to file 'TEST_DIR/tmp/t1.MYI' (Errcode: 17)
		28	+DROP TABLE t2;
		29	+show create table t1;
		30	+Table Create Table
		31	+t1 CREATE TEMPORARY TABLE `t1` (
		32	+ `a` int(11) default NULL
		33	+) ENGINE=MyISAM DEFAULT CHARSET=latin1 DATA DIRECTORY='MYSQL_TEST_DIR/var/log/'
		34	+show create table t1;
		35	+Table Create Table
		36	+t1 CREATE TEMPORARY TABLE `t1` (
		37	+ `a` int(11) default NULL
		38	+) ENGINE=MyISAM DEFAULT CHARSET=latin1 DATA DIRECTORY='MYSQL_TEST_DIR/var/log/'
		39	+create table t1 (a int) engine=myisam select 42 a;
		40	+select * from t1;
		41	+a
		42	+9
		43	+select * from t1;
		44	+a
		45	+99
		46	+select * from t1;
		47	+a
		48	+42
		49	+drop table t1;
		50	+execute stmt;
		51	+show create table t1;
		52	+Table Create Table
		53	+t1 CREATE TABLE `t1` (
		54	+ `c` char(10) default NULL
		55	+) ENGINE=MyISAM DEFAULT CHARSET=latin1 DATA DIRECTORY='MYSQLTEST_VARDIR/tmp/'
		56	+drop table t1;
		57	+execute stmt;
		58	+show create table t1;
		59	+Table Create Table
		60	+t1 CREATE TABLE `t1` (
		61	+ `c` char(10) default NULL
		62	+) ENGINE=MyISAM DEFAULT CHARSET=latin1 DATA DIRECTORY='MYSQLTEST_VARDIR/tmp/'
		63	+drop table t1;
		64	+deallocate prepare stmt;
65	+CREATE TABLE t1(a INT)
66	+DATA DIRECTORY='TEST_DIR/var/master-data/test';
67	+ERROR HY000: Incorrect arguments to DATA DIRECORY
68	+CREATE TABLE t1(a INT)
69	+DATA DIRECTORY='TEST_DIR/var/master-data/';
70	+ERROR HY000: Incorrect arguments to DATA DIRECORY
71	+CREATE TABLE t1(a INT)
72	+INDEX DIRECTORY='TEST_DIR/var/master-data';
73	+ERROR HY000: Incorrect arguments to INDEX DIRECORY
74	+CREATE TABLE t1(a INT)
75	+INDEX DIRECTORY='TEST_DIR/var/master-data_var';
76	+ERROR HY000: Can't create/write to file 'TEST_DIR/var/master-data_var/t1.MYI' (Errcode: 2)
77	+End of 4.1 tests
78

Line 0 Link Here

(-)mysql41-server/files/patch-mysql-test::t::symlink.test (+118 lines)
		1	--- mysql-test/t/symlink.test 2005-12-08 15:13:53 +0000
		2	+++ mysql-test/t/symlink.test 2008-02-29 12:56:41 +0000
		3	@@ -119,18 +119,99 @@
		4	drop table t1;
		5
		6	#
		7	-# Test specifying DATA DIRECTORY that is the same as what would normally
		8	-# have been chosen. (Bug #8707)
		9	-#
		10	-disable_query_log;
		11	-eval create table t1 (i int) data directory = "$MYSQL_TEST_DIR/var/master-data/test/";
		12	-enable_query_log;
		13	-show create table t1;
		14	-drop table t1;
		15	-disable_query_log;
		16	-eval create table t1 (i int) index directory = "$MYSQL_TEST_DIR/var/master-data/test/";
		17	-enable_query_log;
		18	-show create table t1;
		19	-drop table t1;
		20	-
		21	-# End of 4.1 tests
		22	+# BUG#32111 - Security Breach via DATA/INDEX DIRECORY and RENAME TABLE
		23	+#
		24	+--write_file $MYSQLTEST_VARDIR/tmp/t1.MYI
		25	+EOF
		26	+--replace_result $MYSQLTEST_VARDIR TEST_DIR
		27	+--error 1
		28	+eval CREATE TABLE t1(a INT)
		29	+DATA DIRECTORY='$MYSQLTEST_VARDIR/tmp'
		30	+INDEX DIRECTORY='$MYSQLTEST_VARDIR/tmp';
		31	+--replace_result $MYSQLTEST_VARDIR TEST_DIR
		32	+eval CREATE TABLE t2(a INT)
		33	+DATA DIRECTORY='$MYSQLTEST_VARDIR/tmp'
		34	+INDEX DIRECTORY='$MYSQLTEST_VARDIR/tmp';
		35	+--replace_result $MYSQLTEST_VARDIR TEST_DIR
		36	+--error 1
		37	+RENAME TABLE t2 TO t1;
		38	+DROP TABLE t2;
		39	+--remove_file $MYSQLTEST_VARDIR/tmp/t1.MYI
		40	+
		41	+#
		42	+# Bug#8706 - temporary table with data directory option fails
		43	+#
		44	+connect (session1,localhost,root,,);
		45	+connect (session2,localhost,root,,);
		46	+
		47	+connection session1;
		48	+disable_query_log;
		49	+eval create temporary table t1 (a int) engine=myisam data directory="$MYSQL_TEST_DIR/var/log" select 9 a;
		50	+enable_query_log;
		51	+# If running test suite with a non standard tmp dir, the "show create table"
		52	+# will print "DATA_DIRECTORY=". Use replace_result to mask it out
		53	+--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
		54	+show create table t1;
		55	+
		56	+connection session2;
		57	+disable_query_log;
		58	+eval create temporary table t1 (a int) engine=myisam data directory="$MYSQL_TEST_DIR/var/log" select 99 a;
		59	+enable_query_log;
		60	+# If running test suite with a non standard tmp dir, the "show create table"
		61	+# will print "DATA_DIRECTORY=". Use replace_result to mask it out
		62	+--replace_result $MYSQL_TEST_DIR MYSQL_TEST_DIR
		63	+show create table t1;
		64	+
65	+connection default;
66	+create table t1 (a int) engine=myisam select 42 a;
67	+
68	+connection session1;
69	+select * from t1;
70	+disconnect session1;
71	+connection session2;
72	+select * from t1;
73	+disconnect session2;
74	+connection default;
75	+select * from t1;
76	+drop table t1;
77	+
78	+#
79	+# CREATE TABLE with DATA DIRECTORY option
80	+#
81	+# Protect ourselves from data left in tmp/ by a previos possibly failed
82	+# test
83	+--system rm -f $MYSQLTEST_VARDIR/tmp/t1.*
84	+--disable_query_log
85	+eval prepare stmt from "create table t1 (c char(10)) data directory='$MYSQLTEST_VARDIR/tmp'";
86	+--enable_query_log
87	+execute stmt;
88	+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
89	+show create table t1;
90	+drop table t1;
91	+execute stmt;
92	+--replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
93	+show create table t1;
94	+drop table t1;
95	+deallocate prepare stmt;
96	+
97	+#
98	+# Bug#32167 another privilege bypass with DATA/INDEX DIRECORY
99	+#
100	+--replace_result $MYSQL_TEST_DIR TEST_DIR
101	+--error 1210
102	+eval CREATE TABLE t1(a INT)
103	+DATA DIRECTORY='$MYSQL_TEST_DIR/var/master-data/test';
104	+--replace_result $MYSQL_TEST_DIR TEST_DIR
105	+--error 1210
106	+eval CREATE TABLE t1(a INT)
107	+DATA DIRECTORY='$MYSQL_TEST_DIR/var/master-data/';
108	+--replace_result $MYSQL_TEST_DIR TEST_DIR
109	+--error 1210
110	+eval CREATE TABLE t1(a INT)
111	+INDEX DIRECTORY='$MYSQL_TEST_DIR/var/master-data';
112	+--replace_result $MYSQL_TEST_DIR TEST_DIR
113	+--error 1
114	+eval CREATE TABLE t1(a INT)
115	+INDEX DIRECTORY='$MYSQL_TEST_DIR/var/master-data_var';
116	+
117	+--echo End of 4.1 tests
118

Lines 9-11 Link Here

(-)mysql41-server/files/patch-sql::mysqld.cc (+21 lines)
9	#include <syslog.h>	9	#include <syslog.h>
10	#ifdef NEED_SYS_SYSLOG_H	10	#ifdef NEED_SYS_SYSLOG_H
11	#include <sys/syslog.h>	11	#include <sys/syslog.h>
		12	--- sql/mysqld.cc 2007-11-29 10:52:36 +0000
		13	+++ sql/mysqld.cc 2008-02-29 09:55:00 +0000
		14	@@ -390,6 +390,7 @@
		15	char compiled_default_collation_name[]= MYSQL_DEFAULT_COLLATION_NAME;
		16	char language_ptr, default_collation_name, *default_character_set_name;
		17	char mysql_data_home_buff[2], *mysql_data_home=mysql_real_data_home;
		18	+char mysql_unpacked_real_data_home[FN_REFLEN];
		19	struct passwd *user_info;
		20	char server_version[SERVER_VERSION_LENGTH];
		21	char mysqld_unix_port, opt_mysql_tmpdir;
		22	@@ -6896,6 +6897,9 @@
		23	pos[1]= 0;
		24	}
		25	convert_dirname(mysql_real_data_home,mysql_real_data_home,NullS);
		26	+ (void) fn_format(buff, mysql_real_data_home, "", "",
		27	+ (MY_RETURN_REAL_PATH\|MY_RESOLVE_SYMLINKS));
		28	+ (void) unpack_dirname(mysql_unpacked_real_data_home, buff);
		29	convert_dirname(language,language,NullS);
		30	(void) my_load_path(mysql_home,mysql_home,""); // Resolve current dir
		31	(void) my_load_path(mysql_real_data_home,mysql_real_data_home,mysql_home);
		32

Line 0 Link Here

(-)mysql41-server/files/patch-sql::sql_parse.cc (+82 lines)
		1	--- sql/sql_parse.cc 2007-06-12 12:47:36 +0000
		2	+++ sql/sql_parse.cc 2008-02-29 09:55:00 +0000
		3	@@ -65,7 +65,8 @@
		4	const char *table_name);
		5
		6	static TABLE_LIST* get_table_by_alias(TABLE_LIST* tl, const char* db,
		7	- const char* alias);
		8	+ const char* alias);
		9	+static bool test_if_data_home_dir(const char *dir);
		10
		11	const char any_db="any*"; // Special symbol for check_access
		12
		13	@@ -2531,6 +2532,20 @@
		14	"INDEX DIRECTORY option ignored");
		15	create_info.data_file_name= create_info.index_file_name= NULL;
		16	#else
		17	+
		18	+ if (test_if_data_home_dir(lex->create_info.data_file_name))
		19	+ {
		20	+ my_error(ER_WRONG_ARGUMENTS,MYF(0),"DATA DIRECORY");
		21	+ res= -1;
		22	+ break;
		23	+ }
		24	+ if (test_if_data_home_dir(lex->create_info.index_file_name))
		25	+ {
		26	+ my_error(ER_WRONG_ARGUMENTS,MYF(0),"INDEX DIRECORY");
		27	+ res= -1;
		28	+ break;
		29	+ }
		30	+
		31	/* Fix names if symlinked tables */
		32	if (append_file_to_dir(thd, &create_info.data_file_name,
		33	create_table->real_name) \|\|
		34	@@ -5920,3 +5935,47 @@
		35	return negated;
		36	return new Item_func_not(expr);
		37	}
		38	+
		39	+
		40	+/*
		41	+ Check if path does not contain mysql data home directory
		42	+
		43	+ SYNOPSIS
		44	+ test_if_data_home_dir()
		45	+ dir directory
		46	+ conv_home_dir converted data home directory
		47	+ home_dir_len converted data home directory length
		48	+
		49	+ RETURN VALUES
		50	+ 0 ok
		51	+ 1 error
		52	+*/
		53	+
		54	+static bool test_if_data_home_dir(const char *dir)
		55	+{
		56	+ char path[FN_REFLEN], conv_path[FN_REFLEN];
		57	+ uint dir_len, home_dir_len= strlen(mysql_unpacked_real_data_home);
		58	+ DBUG_ENTER("test_if_data_home_dir");
		59	+
		60	+ if (!dir)
		61	+ DBUG_RETURN(0);
		62	+
		63	+ (void) fn_format(path, dir, "", "",
		64	+ (MY_RETURN_REAL_PATH\|MY_RESOLVE_SYMLINKS));
65	+ dir_len= unpack_dirname(conv_path, dir);
66	+
67	+ if (home_dir_len <= dir_len)
68	+ {
69	+ if (lower_case_file_system)
70	+ {
71	+ if (!my_strnncoll(default_charset_info, (const uchar*) conv_path,
72	+ home_dir_len,
73	+ (const uchar*) mysql_unpacked_real_data_home,
74	+ home_dir_len))
75	+ DBUG_RETURN(1);
76	+ }
77	+ else if (!memcmp(conv_path, mysql_unpacked_real_data_home, home_dir_len))
78	+ DBUG_RETURN(1);
79	+ }
80	+ DBUG_RETURN(0);
81	+}
82