database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Code Activity

Merge 11.8 into 12.3

Browse Source
This commit is contained in:
Marko Mäkelä
2026-10-13 12:48:57 +03:00
parent 5e1d303aa6 14362356d1
commit 5981efcecd
3 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mysql-test/main/servers.result
View File

@@ -200,4 +200,10 @@ show create server s1;
Server Create Server
s1 CREATE SERVER `s1` FOREIGN DATA WRAPPER `my'sql` OPTIONS (`ho``st` 'va''lue');
drop server s1;
#
# MDEV-41064 MariaDB Server stack overflow when FLUSH PRIVILEGES parses a large JSON value from mysql.servers.Options inside a stored procedure
#
INSERT INTO mysql.servers (Server_name, Options) VALUES ('t1', CONCAT('{"x": "', REPEAT('a', 12000000), '"}'));
FLUSH PRIVILEGES;
DELETE FROM mysql.servers WHERE Server_name = 't1';
# End of 11.8 tests

8
mysql-test/main/servers.test
View File

@@ -200,4 +200,12 @@ create server s1 foreign data wrapper 'my''sql' options (`ho``st` 'va''lue');
show create server s1;
drop server s1;
--echo #
--echo # MDEV-41064 MariaDB Server stack overflow when FLUSH PRIVILEGES parses a large JSON value from mysql.servers.Options inside a stored procedure
--echo #
INSERT INTO mysql.servers (Server_name, Options) VALUES ('t1', CONCAT('{"x": "', REPEAT('a', 12000000), '"}'));
FLUSH PRIVILEGES;
DELETE FROM mysql.servers WHERE Server_name = 't1';
--echo # End of 11.8 tests

8
sql/sql_servers.cc
View File

@@ -356,14 +356,20 @@ static bool parse_server_options_json(FOREIGN_SERVER *server, char *ptr)
if (option->value.length)
{
LEX_CSTRING *optval= &option->value;
char *unescaped= (char *) alloca(optval->length);
char *unescaped= (char *) my_safe_alloca(optval->length);
if (!unescaped)
DBUG_RETURN(TRUE);
int len= json_unescape_json(optval->str, optval->str + optval->length,
unescaped, unescaped + optval->length);
if (len < 0)
{
my_safe_afree(unescaped, optval->length);
DBUG_RETURN(TRUE);
}
DBUG_ASSERT(len <= (int) optval->length);
if (len < (int) optval->length)
strncpy((char *) optval->str, unescaped, len);
my_safe_afree(unescaped, optval->length);
optval->length= len;
}
}