Last modified: 2006-10-04 08:48:03 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T8890, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 6890 - SQL query error on bad input to [[special:ipblocklist]] due to negative LIMIT clause
SQL query error on bad input to [[special:ipblocklist]] due to negative LIMIT...
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
Special pages (Other open bugs)
1.8.x
All All
: Low minor (vote)
: ---
Assigned To: Nobody - You can work on this!
: patch, patch-need-review
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2006-08-01 07:10 UTC by Nick Jenkins
Modified: 2006-10-04 08:48 UTC (History)
0 users

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments
Simple patch that caps the limit clause to some sensible max value (e.g. 50000) (556 bytes, patch)
2006-10-03 06:07 UTC, Nick Jenkins
Details

Description Nick Jenkins 2006-08-01 07:10:40 UTC
CURL command:
=======================================
curl --silent --include \
 -F 'limit'='09700982312351132098234'\
 'localhost/wiki/index.php/Special:Ipblocklist'
=======================================

Results in this entry in the MediaWiki database error log:
=======================================
Tue Aug 1 17:04:55 EST 2006     bling   IndexPager::reallyDoQuery
(IPBlocklistPager)    localhost       1064 You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the right
syntax to use near '-9223372036854775808' at line 1 (localhost)     SELECT 
`ipblocks`.*,user_name  FROM `ipblocks`,`user`  WHERE
(ipb_expiry>'20060801070455') AND (ipb_by=user_id OR ipb_by=0)  GROUP BY
ipblocks.ipb_id ORDER BY ipb_timestamp DESC  LIMIT -9223372036854775808
=======================================

This is on 64-bit hardware & software; However the limit field value being
passed to MediaWiki exceeds 2^64, so there's possibly an integer wraparound
happening somewhere, which results in the negative limit value being used.
Comment 1 Nick Jenkins 2006-10-03 06:06:04 UTC
The problem here can be illustrated with these 3 steps:
============================
root@bling:~# php --run '$x = 9223372036854775807; $y = $x + 1; print intval($y)
. "\n\n";'
-9223372036854775808

root@bling:~# 
============================

I.e. a wraparound issue, as 2^63 (for a signed int on 64-bit platform) =
9223372036854776000
Comment 2 Nick Jenkins 2006-10-03 06:07:02 UTC
Created attachment 2430 [details]
Simple patch that caps the limit clause to some sensible max value (e.g. 50000)
Comment 3 Nick Jenkins 2006-10-04 08:48:03 UTC
Closed in r16789.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links