#! /bin/sh /usr/share/dpatch/dpatch-run
## 97_SECURITY_CVE-2008-4098.dpatch by Devin Carraway <devin@debian.org>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Backport of upstream fix to CVE-2008-4098, superceding fix to
## CVE-2008-2079.  Limitations in validation of user-supplied DATA DIRECTORY
## and INDEX DIRECTORY clauses to CREATE TABLE statements allowed hostile
## users with write access to the db server's filesystem to acquire write
## privileges to other databases.

@DPATCH@
diff -aruN mysql-dfsg-5.0-5.0.32.orig/include/my_sys.h mysql-dfsg-5.0-5.0.32/include/my_sys.h
--- mysql-dfsg-5.0-5.0.32.orig/include/my_sys.h	2006-12-20 03:14:47.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/include/my_sys.h	2008-10-26 22:58:47.000000000 -0700
@@ -570,6 +570,7 @@
 extern File my_dup(File file, myf MyFlags);
 extern int my_mkdir(const char *dir, int Flags, myf MyFlags);
 extern int my_readlink(char *to, const char *filename, myf MyFlags);
+extern int my_is_symlink(const char *filename);
 extern int my_realpath(char *to, const char *filename, myf MyFlags);
 extern File my_create_with_symlink(const char *linkname, const char *filename,
 				   int createflags, int access_flags,
diff -aruN mysql-dfsg-5.0-5.0.32.orig/include/myisam.h mysql-dfsg-5.0-5.0.32/include/myisam.h
--- mysql-dfsg-5.0-5.0.32.orig/include/myisam.h	2006-12-20 03:14:04.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/include/myisam.h	2008-10-26 22:59:31.000000000 -0700
@@ -268,6 +268,10 @@
 extern my_off_t myisam_max_temp_length;
 extern ulong myisam_bulk_insert_tree_size, myisam_data_pointer_size;
 
+/* usually used to check if a symlink points into the mysql data home */
+/* which is normally forbidden                                        */
+extern int (*myisam_test_invalid_symlink)(const char *filename);
+
 	/* Prototypes for myisam-functions */
 
 extern int mi_close(struct st_myisam_info *file);
diff -aruN mysql-dfsg-5.0-5.0.32.orig/myisam/mi_check.c mysql-dfsg-5.0-5.0.32/myisam/mi_check.c
--- mysql-dfsg-5.0-5.0.32.orig/myisam/mi_check.c	2006-12-20 03:14:48.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/myisam/mi_check.c	2008-10-26 23:00:39.000000000 -0700
@@ -1560,7 +1560,7 @@
 			    DATA_TMP_EXT, share->base.raid_chunks,
 			    (param->testflag & T_BACKUP_DATA ?
 			     MYF(MY_REDEL_MAKE_BACKUP): MYF(0))) ||
-	  mi_open_datafile(info,share,-1))
+	  mi_open_datafile(info,share,name,-1))
 	got_error=1;
     }
   }
@@ -2340,7 +2340,7 @@
 			    DATA_TMP_EXT, share->base.raid_chunks,
 			    (param->testflag & T_BACKUP_DATA ?
 			     MYF(MY_REDEL_MAKE_BACKUP): MYF(0))) ||
-	  mi_open_datafile(info,share,-1))
+	  mi_open_datafile(info,share,name,-1))
 	got_error=1;
     }
   }
@@ -2872,7 +2872,7 @@
 			    DATA_TMP_EXT, share->base.raid_chunks,
 			    (param->testflag & T_BACKUP_DATA ?
 			     MYF(MY_REDEL_MAKE_BACKUP): MYF(0))) ||
-	  mi_open_datafile(info,share,-1))
+	  mi_open_datafile(info,share,name,-1))
 	got_error=1;
     }
   }
diff -aruN mysql-dfsg-5.0-5.0.32.orig/myisam/mi_open.c mysql-dfsg-5.0-5.0.32/myisam/mi_open.c
--- mysql-dfsg-5.0-5.0.32.orig/myisam/mi_open.c	2006-12-20 03:14:25.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/myisam/mi_open.c	2008-10-26 23:03:52.000000000 -0700
@@ -75,7 +75,7 @@
 
 MI_INFO *mi_open(const char *name, int mode, uint open_flags)
 {
-  int lock_error,kfile,open_mode,save_errno,have_rtree=0;
+  int lock_error,kfile,open_mode,save_errno,have_rtree=0, realpath_err;
   uint i,j,len,errpos,head_length,base_pos,offset,info_length,keys,
     key_parts,unique_key_parts,fulltext_keys,uniques;
   char name_buff[FN_REFLEN], org_name[FN_REFLEN], index_name[FN_REFLEN],
@@ -96,6 +96,15 @@
   bzero((byte*) &info,sizeof(info));
 
   my_realpath(name_buff, fn_format(org_name,name,"",MI_NAME_IEXT,4),MYF(0));
+  realpath_err= my_realpath(name_buff,
+                  fn_format(org_name,name,"",MI_NAME_IEXT,4),MYF(0));
+  if (my_is_symlink(org_name) &&
+      (realpath_err || (*myisam_test_invalid_symlink)(name_buff)))
+  {
+    my_errno= HA_WRONG_CREATE_OPTION;
+    DBUG_RETURN (NULL);
+  }
+
   pthread_mutex_lock(&THR_LOCK_myisam);
   if (!(old_info=test_if_reopen(name_buff)))
   {
@@ -448,7 +457,7 @@
       lock_error=1;			/* Database unlocked */
     }
 
-    if (mi_open_datafile(&info, share, -1))
+    if (mi_open_datafile(&info, share, name, -1))
       goto err;
     errpos=5;
 
@@ -518,7 +527,7 @@
       my_errno=EACCES;				/* Can't open in write mode */
       goto err;
     }
-    if (mi_open_datafile(&info, share, old_info->dfile))
+    if (mi_open_datafile(&info, share, name, old_info->dfile))
       goto err;
     errpos=5;
     have_rtree= old_info->rtree_recursion_state != NULL;
@@ -1163,12 +1172,29 @@
 exist a dup()-like call that would give us two different file descriptors.
 *************************************************************************/
 
-int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share, File file_to_dup __attribute__((unused)))
+int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share, const char *org_name, File file_to_dup __attribute__((unused)))
 {
+  char *data_name= share->data_file_name;
+  char real_data_name[FN_REFLEN];
+
+  if (org_name)
+  {
+    fn_format(real_data_name,org_name,"",MI_NAME_DEXT,4);
+    if (my_is_symlink(real_data_name))
+    {
+      if (my_realpath(real_data_name, real_data_name, MYF(0)) ||
+          (*myisam_test_invalid_symlink)(real_data_name))
+      {
+        my_errno= HA_WRONG_CREATE_OPTION;
+        return 1;
+      }
+      data_name= real_data_name;
+    }
+  }
 #ifdef USE_RAID
   if (share->base.raid_type)
   {
-    info->dfile=my_raid_open(share->data_file_name,
+    info->dfile=my_raid_open(data_name,
 			     share->mode | O_SHARE,
 			     share->base.raid_type,
 			     share->base.raid_chunks,
@@ -1177,7 +1203,7 @@
   }
   else
 #endif
-    info->dfile=my_open(share->data_file_name, share->mode | O_SHARE,
+    info->dfile=my_open(data_name, share->mode | O_SHARE,
 			MYF(MY_WME));
   return info->dfile >= 0 ? 0 : 1;
 }
diff -aruN mysql-dfsg-5.0-5.0.32.orig/myisam/mi_static.c mysql-dfsg-5.0-5.0.32/myisam/mi_static.c
--- mysql-dfsg-5.0-5.0.32.orig/myisam/mi_static.c	2006-12-20 03:14:00.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/myisam/mi_static.c	2008-10-26 23:04:25.000000000 -0700
@@ -42,6 +42,15 @@
 ulong    myisam_bulk_insert_tree_size=8192*1024;
 ulong    myisam_data_pointer_size=4;
 
+
+static int always_valid(const char *filename)
+{
+  return 0;
+}
+
+int (*myisam_test_invalid_symlink)(const char *filename)= always_valid;
+
+
 /*
   read_vec[] is used for converting between P_READ_KEY.. and SEARCH_
   Position is , == , >= , <= , > , <
diff -aruN mysql-dfsg-5.0-5.0.32.orig/myisam/myisamchk.c mysql-dfsg-5.0-5.0.32/myisam/myisamchk.c
--- mysql-dfsg-5.0-5.0.32.orig/myisam/myisamchk.c	2006-12-20 03:14:39.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/myisam/myisamchk.c	2008-10-26 23:04:43.000000000 -0700
@@ -1039,7 +1039,7 @@
 	  error|=change_to_newfile(filename,MI_NAME_DEXT,DATA_TMP_EXT,
 				   raid_chunks,
 				   MYF(0));
-	  if (mi_open_datafile(info,info->s, -1))
+	  if (mi_open_datafile(info,info->s, NULL, -1))
 	    error=1;
 	  param->out_flag&= ~O_NEW_DATA; /* We are using new datafile */
 	  param->read_cache.file=info->dfile;
diff -aruN mysql-dfsg-5.0-5.0.32.orig/myisam/myisamdef.h mysql-dfsg-5.0-5.0.32/myisam/myisamdef.h
--- mysql-dfsg-5.0-5.0.32.orig/myisam/myisamdef.h	2006-12-20 03:14:10.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/myisam/myisamdef.h	2008-10-26 23:05:17.000000000 -0700
@@ -738,7 +738,9 @@
 
 extern MI_INFO *test_if_reopen(char *filename);
 my_bool check_table_is_closed(const char *name, const char *where);
-int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share, File file_to_dup);
+int mi_open_datafile(MI_INFO *info, MYISAM_SHARE *share, const char *orn_name,
+                     File file_to_dup);
+
 int mi_open_keyfile(MYISAM_SHARE *share);
 void mi_setup_functions(register MYISAM_SHARE *share);
 
diff -aruN mysql-dfsg-5.0-5.0.32.orig/mysys/my_symlink.c mysql-dfsg-5.0-5.0.32/mysys/my_symlink.c
--- mysql-dfsg-5.0-5.0.32.orig/mysys/my_symlink.c	2006-12-20 03:14:04.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/mysys/my_symlink.c	2008-10-26 23:10:44.000000000 -0700
@@ -107,38 +107,38 @@
 #define BUFF_LEN FN_LEN
 #endif
 
+int my_is_symlink(const char *filename __attribute__((unused)))
+{
+  struct stat stat_buff;
+  return !lstat(filename, &stat_buff) && S_ISLNK(stat_buff.st_mode);
+}
+
+
 int my_realpath(char *to, const char *filename,
 		myf MyFlags __attribute__((unused)))
 {
 #if defined(HAVE_REALPATH) && !defined(HAVE_purify) && !defined(HAVE_BROKEN_REALPATH)
   int result=0;
   char buff[BUFF_LEN];
-  struct stat stat_buff;
+  char *ptr;
   DBUG_ENTER("my_realpath");
 
-  if (!(MyFlags & MY_RESOLVE_LINK) ||
-      (!lstat(filename,&stat_buff) && S_ISLNK(stat_buff.st_mode)))
-  {
-    char *ptr;
-    DBUG_PRINT("info",("executing realpath"));
-    if ((ptr=realpath(filename,buff)))
-    {
+  DBUG_PRINT("info",("executing realpath"));
+  if ((ptr=realpath(filename,buff)))
       strmake(to,ptr,FN_REFLEN-1);
-    }
-    else
-    {
-      /*
-	Realpath didn't work;  Use my_load_path() which is a poor substitute
-	original name but will at least be able to resolve paths that starts
-	with '.'.
-      */
-      DBUG_PRINT("error",("realpath failed with errno: %d", errno));
-      my_errno=errno;
-      if (MyFlags & MY_WME)
-	my_error(EE_REALPATH, MYF(0), filename, my_errno);
-      my_load_path(to, filename, NullS);
-      result= -1;
-    }
+  else
+  {
+    /*
+      Realpath didn't work;  Use my_load_path() which is a poor substitute
+      original name but will at least be able to resolve paths that starts
+      with '.'.
+    */
+    DBUG_PRINT("error",("realpath failed with errno: %d", errno));
+    my_errno=errno;
+    if (MyFlags & MY_WME)
+      my_error(EE_REALPATH, MYF(0), filename, my_errno);
+    my_load_path(to, filename, NullS);
+    result= -1;
   }
   DBUG_RETURN(result);
 #else
diff -aruN mysql-dfsg-5.0-5.0.32.orig/sql/mysql_priv.h mysql-dfsg-5.0-5.0.32/sql/mysql_priv.h
--- mysql-dfsg-5.0-5.0.32.orig/sql/mysql_priv.h	2008-10-26 22:55:09.000000000 -0700
+++ mysql-dfsg-5.0-5.0.32/sql/mysql_priv.h	2008-10-26 23:38:05.000000000 -0700
@@ -1193,7 +1193,9 @@
 extern time_t start_time;
 extern char *mysql_data_home,server_version[SERVER_VERSION_LENGTH],
 	    mysql_real_data_home[], *opt_mysql_tmpdir, mysql_charsets_dir[],
+        mysql_unpacked_real_data_home[],
             def_ft_boolean_syntax[sizeof(ft_boolean_syntax)];
+extern int mysql_unpacked_real_data_home_len;
 #define mysql_tmpdir (my_tmpdir(&mysql_tmpdir_list))
 extern MY_TMPDIR mysql_tmpdir_list;
 extern const char *command_name[];
@@ -1684,4 +1686,6 @@
 #define check_stack_overrun(A, B, C) 0
 #endif
 
+extern "C" int test_if_data_home_dir(const char *dir);
+
 #endif /* MYSQL_CLIENT */
diff -aruN mysql-dfsg-5.0-5.0.32.orig/sql/mysqld.cc mysql-dfsg-5.0-5.0.32/sql/mysqld.cc
--- mysql-dfsg-5.0-5.0.32.orig/sql/mysqld.cc	2006-12-20 03:14:10.000000000 -0800
+++ mysql-dfsg-5.0-5.0.32/sql/mysqld.cc	2008-10-26 23:25:18.000000000 -0700
@@ -437,8 +437,9 @@
 char mysql_real_data_home[FN_REFLEN],
      language[FN_REFLEN], reg_ext[FN_EXTLEN], mysql_charsets_dir[FN_REFLEN],
      *opt_init_file, *opt_tc_log_file,
+     mysql_unpacked_real_data_home[FN_REFLEN],
      def_ft_boolean_syntax[sizeof(ft_boolean_syntax)];
-
+int mysql_unpacked_real_data_home_len;
 const key_map key_map_empty(0);
 key_map key_map_full(0);                        // Will be initialized later
 
@@ -6344,6 +6345,7 @@
   /* Things reset to zero */
   opt_skip_slave_start= opt_reckless_slave = 0;
   mysql_home[0]= pidfile_name[0]= log_error_file[0]= 0;
+  myisam_test_invalid_symlink= test_if_data_home_dir;
   opt_log= opt_update_log= opt_slow_log= 0;
   opt_bin_log= 0;
   opt_disable_networking= opt_skip_show_db=0;
@@ -7358,7 +7360,11 @@
   convert_dirname(mysql_real_data_home,mysql_real_data_home,NullS);
   convert_dirname(language,language,NullS);
   (void) my_load_path(mysql_home,mysql_home,""); // Resolve current dir
-  (void) my_load_path(mysql_real_data_home,mysql_real_data_home,mysql_home);
+  my_realpath(mysql_unpacked_real_data_home, mysql_real_data_home, MYF(0));
+  mysql_unpacked_real_data_home_len= strlen(mysql_unpacked_real_data_home);
+  if (mysql_unpacked_real_data_home[mysql_unpacked_real_data_home_len-1] == FN_LIBCHAR)
+    --mysql_unpacked_real_data_home_len;
+
   (void) my_load_path(pidfile_name,pidfile_name,mysql_real_data_home);
 
   char *sharedir=get_relative_path(SHAREDIR);
diff -aruN mysql-dfsg-5.0-5.0.32.orig/sql/sql_parse.cc mysql-dfsg-5.0-5.0.32/sql/sql_parse.cc
--- mysql-dfsg-5.0-5.0.32.orig/sql/sql_parse.cc	2008-10-26 22:55:09.000000000 -0700
+++ mysql-dfsg-5.0-5.0.32/sql/sql_parse.cc	2008-10-26 23:23:01.000000000 -0700
@@ -2890,6 +2890,19 @@
 #ifndef HAVE_READLINK
     lex->create_info.data_file_name=lex->create_info.index_file_name=0;
 #else
+    if (test_if_data_home_dir(lex->create_info.data_file_name))
+    {
+      my_error(ER_WRONG_ARGUMENTS,MYF(0),"DATA DIRECTORY");
+      res= -1;
+      break;
+    }
+    if (test_if_data_home_dir(lex->create_info.index_file_name))
+    {
+      my_error(ER_WRONG_ARGUMENTS,MYF(0),"INDEX DIRECTORY");
+      res= -1;
+      break;
+    }
+
     /* Fix names if symlinked tables */
     if (append_file_to_dir(thd, &lex->create_info.data_file_name,
 			   create_table->table_name) ||
@@ -7664,3 +7677,55 @@
 
   return TRUE;
 }
+
+
+/*
+  Check if path does not contain mysql data home directory
+
+  SYNOPSIS
+    test_if_data_home_dir()
+    dir                     directory
+    conv_home_dir           converted data home directory
+    home_dir_len            converted data home directory length
+
+  RETURN VALUES
+    0	ok
+    1	error  
+*/
+
+C_MODE_START
+
+int test_if_data_home_dir(const char *dir)
+{
+  char path[FN_REFLEN];
+  int dir_len;
+  DBUG_ENTER("test_if_data_home_dir");
+
+  if (!dir)
+    DBUG_RETURN(0);
+
+  (void) fn_format(path, dir, "", "",
+                   (MY_RETURN_REAL_PATH|MY_RESOLVE_SYMLINKS));
+  dir_len= strlen(path);
+  if (mysql_unpacked_real_data_home_len<= dir_len)
+  {
+    if (dir_len > mysql_unpacked_real_data_home_len &&
+        path[mysql_unpacked_real_data_home_len] != FN_LIBCHAR)
+      DBUG_RETURN(0);
+
+    if (lower_case_file_system)
+    {
+      if (!my_strnncoll(default_charset_info, (const uchar*) path,
+                        mysql_unpacked_real_data_home_len,
+                        (const uchar*) mysql_unpacked_real_data_home,
+                        mysql_unpacked_real_data_home_len))
+        DBUG_RETURN(1);
+    }
+    else if (!memcmp(path, mysql_unpacked_real_data_home,
+                     mysql_unpacked_real_data_home_len))
+      DBUG_RETURN(1);
+  }
+  DBUG_RETURN(0);
+}
+
+C_MODE_END