database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-15127 AddressSanitizer: stack-buffer-overflow in base_list::push_back ..

Browse Source 
Problem:-
 If we try to run this query with -WITH_ASAN=ON compiled server
  CREATE TABLE t1 (i INT);
  SET debug_dbug="+d,test_completely_invisible,test_invisible_index";
  CREATE TABLE t2 LIKE t1;

 This will generate a stack buffer overflow error.
  ==8922==ERROR: AddressSanitizer: stack-buffer-overflow on address #ADDR
Analyze:-
 Error is generated on this line
       if (((*last)=new list_node(info, &end_of_list)))
 So info is our Key*, &end_of_list is global variable and last == #ADDR
 So last is suspicious variable. And last is the variable present in alter_info
 ->key_list. Now the question is how this key_list->last gets wrong/
 different stack variable. In the backtrace,  we can see that key_list is
 generated in mysql_create_table_like_table by calling
 mysql_preapre_alter_table_function and dummy key_list is created by
 mysql_create_like_table. In the end on mysql_prepare_alter_table we call
   alter_info->key_list.swap(new_key_list);
 So there is two options either key_list is empty or not empty , IF it is not
 empty then there is no issues last ptr is replaced by thd->mem_root (allocated ptr)
 So problem arises when key_list is empty. It swaps the dummy last ptr by
 mysql_prepare_alter_table declared ptr. which is wrong.

Solution:-
 We wont swap variable if list does not have any element.
This commit is contained in:
Sachin
2018-08-07 16:05:48 +05:30
parent 4cbadaeaea
commit 482d4da0a7
3 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/main/invisible_field_debug.test
View File

@ -270,3 +270,9 @@ explain select * from t1 where invisible =9;
show indexes in t1;
drop table t1;
set @old_debug= @@debug_dbug;
## MDEV 15127
CREATE TABLE t1 (i INT );
SET debug_dbug="+d,test_completely_invisible,test_invisible_index";
CREATE TABLE t2 LIKE t1;
SET debug_dbug= DEFAULT;
DROP TABLE t1, t2;