Fix stack buffer corruption on destroy_sql_pool

Signed-off-by: mkhullar <mohit.khullar@gmail.com>

Author: mohitkhullar

db/process_message.c

@@ -1381,6 +1381,10 @@ int process_command(struct dbenv *dbenv, char *line, int lline, int st)
     else if (tokcmp(tok, ltok, "destroy_sql_pool") == 0) {
         char zPoolName[PATH_MAX];
         tok = segtok(line, lline, &st, &ltok);
+        if (ltok >= PATH_MAX) {
+            logmsg(LOGMSG_USER, "pool name too long. Max: %d\n", PATH_MAX - 1);
+            return -1;
+        }
         if (ltok != 0) {
             tokcpy(tok, ltok, zPoolName);
             rc = destroy_sql_pool(zPoolName, SQL_POOL_STOP_TIMEOUT_US);

lua/syssp.c.in

@@ -489,8 +489,7 @@ static int db_send(Lua L)
 
     if (!lua_isstring(L, 1))
         return luaL_error(L, "Expected string argument");
-    cmd = (char*) lua_tostring(L, -1);
-    lua_settop(L, 0);
+    cmd = (char*) lua_tostring(L, 1);
 
     return _db_process_command(L, cmd, "out");
 }

tests/destroy_sql_pool_overflow.test/Makefile

@@ -0,0 +1,7 @@
+ifeq ($(TESTSROOTDIR),)
+  include ../testcase.mk
+else
+  include $(TESTSROOTDIR)/testcase.mk
+endif
+
+export TEST_TIMEOUT=1m

tests/destroy_sql_pool_overflow.test/runit

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+bash -n "$0" || exit 1
+
+dbnm=$1
+
+long_name=$(printf 'A%.0s' $(seq 1 5000))
+
+# Should return error, not crash the server
+cdb2sql ${CDB2_OPTIONS} $dbnm default "EXEC PROCEDURE sys.cmd.send('destroy_sql_pool $long_name')" >/dev/null 2>&1
+
+# Verify server is still alive
+cdb2sql ${CDB2_OPTIONS} $dbnm default "SELECT 'alive'" >output.actual 2>&1
+
+grep -q "('alive'='alive')" output.actual
+if [ $? -ne 0 ]; then
+    echo "FAILURE: server not responding after overflow attempt"
+    cat output.actual
+    exit 1
+fi
+
+echo "SUCCESS"