database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-18734 ASAN heap-use-after-free upon sorting by blob column from partitioned table

Browse Source 
ha_partition stores records in array of m_ordered_rec_buffer and uses
it for prio queue in ordered index scan. When the records are restored
from the array the blob buffers may be already freed or rewritten.

The solution is to take temporary ownership of cached blob buffers via
String::swap(). When the record is restored from m_ordered_rec_buffer
the ownership is returned to table fields.

Cleanups:

init_record_priority_queue(): removed needless !m_ordered_rec_buffer
check as there is same assertion few lines before.

dbug_print_row() for arbitrary row pointer
This commit is contained in:
Aleksey Midenkov
2021-08-05 23:48:02 +03:00
parent b8deb02859
commit 160d97a4aa
9 changed files with 382 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
sql/field.h
View File

@ -3465,6 +3465,12 @@ public:
uchar *new_ptr, uint32 length,
uchar *new_null_ptr, uint new_null_bit);
void sql_type(String &str) const;
/**
Copy blob buffer into internal storage "value" and update record pointer.
@retval true Memory allocation error
@retval false Success
*/
inline bool copy()
{
uchar *tmp= get_ptr();
@ -3477,6 +3483,33 @@ public:
memcpy(ptr+packlength, &tmp, sizeof(char*));
return 0;
}
void swap(String &inout, bool set_read_value)
{
if (set_read_value)
read_value.swap(inout);
else
value.swap(inout);
}
/**
Return pointer to blob cache or NULL if not cached.
*/
String * cached(bool *set_read_value)
{
char *tmp= (char *) get_ptr();
if (!value.is_empty() && tmp == value.ptr())
{
*set_read_value= false;
return &value;
}
if (!read_value.is_empty() && tmp == read_value.ptr())
{
*set_read_value= true;
return &read_value;
}
return NULL;
}
/* store value for the duration of the current read record */
inline void swap_value_and_read_value()
{