Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix EOF detection in the MySQL protocol analyzer.

Browse source 
The MySQL
documentation (https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_basic_eof_packet.html)
warns us that "You must check whether the packet length is less than 9
to make sure that it is a EOF_Packet packet."

While we were doing this in two places, we were comparing the total
packet length, which includes the 4-byte header. Changed to compare to
13 instead.
This commit is contained in:
Vlad Grigorescu 2020-03-05 11:35:27 -06:00
parent 1b252038c5
commit d961e21185
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/analyzer/protocol/mysql/mysql-protocol.pac
View file

@ -311,7 +311,7 @@ type ColumnDefinitionOrEOF(pkt_len: uint32) = record {
false -> def: ColumnDefinition41(marker);
} &requires(is_eof);
} &let {
is_eof: bool = (marker == 0xfe && pkt_len <= 9);
is_eof: bool = (marker == 0xfe && pkt_len <= 13);
};
@ -329,7 +329,7 @@ type Resultset(pkt_len: uint32) = record {
false -> row: ResultsetRow(marker);
} &requires(is_eof);
} &let {
is_eof: bool = (marker == 0xfe && pkt_len <= 9);
is_eof: bool = (marker == 0xfe && pkt_len <= 13);
update_result_seen : bool = $context.connection.inc_results_seen();
update_expectation : bool = $context.connection.set_next_expected(is_eof ? NO_EXPECTATION : EXPECT_RESULTSET);
};