database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Code Activity

MDEV-40616: MSAN - use-of-uninitialized-value in extract_date_time()

Browse Source 
Problem:
  STR_TO_DATE(str, format) with %., %@ and %# format specifiers could
  read past the end of str, because the loops in extract_date_time()
  read a byte before checking for the end of str. When str was not
  NUL-terminated, that byte was uninitialized, causing the MSAN error.

Fix:
  Check for the end of str before reading the next byte.
This commit is contained in:
Raghunandan Bhat
2026-10-20 17:25:24 +05:30
committed by Raghunandan Bhat
parent f5f6a3e1f2
commit 120162359b
3 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/main/func_time.result
View File

@@ -6451,4 +6451,10 @@ Warning 1292 Incorrect time value: '9430886' for column `test`.`t1`.`c2` at row
Warning 1292 Incorrect time value: '9430816' for column `test`.`t1`.`c1` at row 2
Warning 1292 Incorrect time value: '9430816' for column `test`.`t1`.`c2` at row 2
drop table t1;
#
# MDEV-40616: MSAN - use-of-uninitialized-value in extract_date_time()
#
DO STR_TO_DATE(1, '%#');
DO STR_TO_DATE(LOWER('q'), '%@');
DO STR_TO_DATE(LOWER('.'), '%.');
# End of 10.11 tests

8
mysql-test/main/func_time.test
View File

@@ -3287,4 +3287,12 @@ insert into t1 values (9430886, 9430886), (9430816, 9430816);
select cast(c1 as time), cast(c2 as time) from t1;
drop table t1;
--echo #
--echo # MDEV-40616: MSAN - use-of-uninitialized-value in extract_date_time()
--echo #
DO STR_TO_DATE(1, '%#');
DO STR_TO_DATE(LOWER('q'), '%@');
DO STR_TO_DATE(LOWER('.'), '%.');
--echo # End of 10.11 tests

6
sql/item_timefunc.cc
View File

@@ -337,15 +337,15 @@ static bool extract_date_time(THD *thd, DATE_TIME_FORMAT *format,
/* Conversion specifiers that match classes of characters */
case '.':
while (my_ispunct(cs, *val) && val != val_end)
while (val < val_end && my_ispunct(cs, *val))
val++;
break;
case '@':
while (my_isalpha(cs, *val) && val != val_end)
while (val < val_end && my_isalpha(cs, *val))
val++;
break;
case '#':
while (my_isdigit(cs, *val) && val != val_end)
while (val < val_end && my_isdigit(cs, *val))
val++;
break;
default: