database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

Bug #31674599: THE UDF_INIT() FUNCTION CAUSE SERVER CRASH

Browse Source
This commit is contained in:
Sergei Golubchik
2021-04-26 16:52:32 +02:00
parent 883b723d7c
commit 4f63b6cf53
3 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
mysql-test/r/udf.result
View File

@ -492,4 +492,12 @@ select * from mysql.plugin WHERE name='unexisting_udf';
name dl name dl
DROP FUNCTION unexisting_udf; DROP FUNCTION unexisting_udf;
ERROR 42000: FUNCTION test.unexisting_udf does not exist ERROR 42000: FUNCTION test.unexisting_udf does not exist
#
# Bug #31674599: THE UDF_INIT() FUNCTION CAUSE SERVER CRASH
#
call mtr.add_suppression('Invalid row in mysql.func table');
insert mysql.func () values ();
delete from mysql.func where name = '';
#
# End of 10.2 tests # End of 10.2 tests
#

10
mysql-test/t/udf.test
View File

@ -562,4 +562,14 @@ select * from mysql.plugin WHERE name='unexisting_udf';
--error ER_SP_DOES_NOT_EXIST --error ER_SP_DOES_NOT_EXIST
DROP FUNCTION unexisting_udf; DROP FUNCTION unexisting_udf;
--echo #
--echo # Bug #31674599: THE UDF_INIT() FUNCTION CAUSE SERVER CRASH
--echo #
call mtr.add_suppression('Invalid row in mysql.func table');
insert mysql.func () values ();
source include/restart_mysqld.inc;
delete from mysql.func where name = '';
--echo #
--echo # End of 10.2 tests --echo # End of 10.2 tests
--echo #

6
sql/sql_udf.cc
View File

@ -196,7 +196,7 @@ void udf_init()
DBUG_PRINT("info",("init udf record")); DBUG_PRINT("info",("init udf record"));
LEX_STRING name; LEX_STRING name;
name.str=get_field(&mem, table->field[0]); name.str=get_field(&mem, table->field[0]);
name.length = (uint) strlen(name.str); name.length = (uint) safe_strlen(name.str);
char *dl_name= get_field(&mem, table->field[2]); char *dl_name= get_field(&mem, table->field[2]);
bool new_dl=0; bool new_dl=0;
Item_udftype udftype=UDFTYPE_FUNCTION; Item_udftype udftype=UDFTYPE_FUNCTION;
@ -210,12 +210,12 @@ void udf_init()
On windows we must check both FN_LIBCHAR and '/'. On windows we must check both FN_LIBCHAR and '/'.
*/ */
if (check_valid_path(dl_name, strlen(dl_name)) || if (!name.str || !dl_name || check_valid_path(dl_name, strlen(dl_name)) ||
check_string_char_length(&name, 0, NAME_CHAR_LEN, check_string_char_length(&name, 0, NAME_CHAR_LEN,
system_charset_info, 1)) system_charset_info, 1))
{ {
sql_print_error("Invalid row in mysql.func table for function '%.64s'", sql_print_error("Invalid row in mysql.func table for function '%.64s'",
name.str); safe_str(name.str));
continue; continue;
} }