database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-05 13:16:09 +03:00
Code Activity

MDEV-21748 ASAN use-after-poison in PageBulk::insertPage()

Browse Source 
PageBulk::insertPage(): Check the array bounds before comparing.
We used to read one byte beyond the end of the 'rec' payload.
The incorrect logic was originally introduced in
commit 7ae21b18a6.
This commit is contained in:
Marko Mäkelä
2020-03-10 10:23:04 +02:00
committed by Sergei Golubchik
parent e2e2f89303
commit 561b5ce364
3 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
mysql-test/suite/innodb/r/alter_table.result
View File

@@ -68,3 +68,13 @@ t2 CREATE TABLE `t2` (
alter table t1 engine=innodb; alter table t1 engine=innodb;
alter table t1 add column b int; alter table t1 add column b int;
drop table t1,t2; drop table t1,t2;
#
# MDEV-21748 ASAN use-after-poison in PageBulk::insertPage()
#
CREATE TABLE t1 (pk TIMESTAMP PRIMARY KEY, a TIMESTAMP NULL UNIQUE)
ENGINE=InnoDB;
INSERT INTO t1 VALUES
('2020-03-10 10:21:00', NULL),
('0000-00-00 00:00:00', '0000-00-00 00:00:00');
ALTER TABLE t1 FORCE, ALGORITHM=INPLACE;
DROP TABLE t1;

11
mysql-test/suite/innodb/t/alter_table.test
View File

@@ -71,3 +71,14 @@ show create table t2;
alter table t1 engine=innodb; alter table t1 engine=innodb;
alter table t1 add column b int; alter table t1 add column b int;
drop table t1,t2; drop table t1,t2;
--echo #
--echo # MDEV-21748 ASAN use-after-poison in PageBulk::insertPage()
--echo #
CREATE TABLE t1 (pk TIMESTAMP PRIMARY KEY, a TIMESTAMP NULL UNIQUE)
ENGINE=InnoDB;
INSERT INTO t1 VALUES
('2020-03-10 10:21:00', NULL),
('0000-00-00 00:00:00', '0000-00-00 00:00:00');
ALTER TABLE t1 FORCE, ALGORITHM=INPLACE;
DROP TABLE t1;

4
storage/innobase/btr/btr0bulk.cc
View File

@@ -270,9 +270,11 @@ no_data:
byte *bd= insert_rec; byte *bd= insert_rec;
const byte *rd= rec; const byte *rd= rec;
/* Skip any unchanged prefix of the record. */ /* Skip any unchanged prefix of the record. */
for (; *bd == *rd; cd++, bd++, rd++) for (;; cd++, bd++, rd++)
if (bd == insert_rec_end) if (bd == insert_rec_end)
goto no_data; goto no_data;
else if (*bd != *rd)
break;
/* Try to copy any data bytes of the preceding record. */ /* Try to copy any data bytes of the preceding record. */
if (c_end - cd > 2) if (c_end - cd > 2)