database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-01-06 05:22:24 +03:00
Code Activity

MDEV-23569 temporary tables can overwrite existing files

Browse Source 
for internal temporary tables: don't use realpath(),
and let them overwrite whatever orphan temp files might've
left in the tmpdir (see main.error_simulation test).

for user created temporary tables: we have to use realpath(),
(see 3a726ab6e2, remember DATA/INDEX DIRECTORY). don't allow
them to overwrite existing files.

This bug was reported by RACK911 LABS
This commit is contained in:
Sergei Golubchik
2020-08-24 18:52:44 +02:00
parent 29d9df16ff
commit 62d1e3bf67
4 changed files with 51 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
mysql-test/r/temp_table_symlink.result Normal file
View File

@@ -0,0 +1,13 @@
create table d1 (a int);
create temporary table t1 (a int);
create temporary table t2 (a int);
Got one of the listed errors
create temporary table t3 (a int) engine=Aria;
Got one of the listed errors
select * from information_schema.columns where table_schema='test';
Got one of the listed errors
flush tables;
select * from d1;
a
drop temporary table t1;
drop table d1;

32
mysql-test/t/temp_table_symlink.test Normal file
View File

@@ -0,0 +1,32 @@
source include/not_windows.inc;
#
# MDEV-23569 temporary tables can overwrite existing files
#
let datadir=`select @@datadir`;
create table d1 (a int);
create temporary table t1 (a int);
perl;
chdir "$ENV{MYSQL_TMP_DIR}/mysqld.1/";
for (<#sql*.MYI>) {
/^#sql(.*)_([0-9a-f]+_)([0-9a-f]+)\.MYI$/ or die;
symlink "$ENV{datadir}/test/d1.MYI", sprintf "#sql$1_$2%x.MYI", hex($3)+1;
symlink "$ENV{datadir}/test/d1.MYI", sprintf "#sql$1_$2%x.MAI", hex($3)+1;
symlink "$ENV{datadir}/test/d1.MYI", sprintf "#sql$1_$2%x.MAI", hex($3)+2;
symlink "$ENV{datadir}/test/d1.MYI", "#sql_$1_0.MAI";
}
EOF
error 1,1030;
create temporary table t2 (a int);
error 1,1030;
create temporary table t3 (a int) engine=Aria;
error 1,1030;
select * from information_schema.columns where table_schema='test';
flush tables;
select * from d1;
drop temporary table t1;
remove_files_wildcard $MYSQL_TMP_DIR/mysqld.1 *sql*;
drop table d1;

6
storage/maria/ma_create.c
View File

@@ -322,7 +322,7 @@ int maria_create(const char *name, enum data_file_type datafile_type,
{
options|= HA_OPTION_TMP_TABLE;
tmp_table= TRUE;
create_mode|= O_NOFOLLOW;
create_mode|= O_NOFOLLOW | (internal_table ? 0 : O_EXCL);
/* "CREATE TEMPORARY" tables are not crash-safe (dropped at restart) */
ci->transactional= FALSE;
flags&= ~HA_CREATE_PAGE_CHECKSUM;
@@ -887,8 +887,8 @@ int maria_create(const char *name, enum data_file_type datafile_type,
{
char *iext= strrchr(name, '.');
int have_iext= iext && !strcmp(iext, MARIA_NAME_IEXT);
fn_format(kfilename, name, "", MARIA_NAME_IEXT,
MY_UNPACK_FILENAME | MY_RETURN_REAL_PATH |
fn_format(kfilename, name, "", MARIA_NAME_IEXT, MY_UNPACK_FILENAME |
(internal_table ? 0 : MY_RETURN_REAL_PATH) |
(have_iext ? MY_REPLACE_EXT : MY_APPEND_EXT));
klinkname_ptr= NullS;
/*

6
storage/myisam/mi_create.c
View File

@@ -184,7 +184,7 @@ int mi_create(const char *name,uint keys,MI_KEYDEF *keydefs,
if (flags & HA_CREATE_TMP_TABLE)
{
options|= HA_OPTION_TMP_TABLE;
create_mode|= O_NOFOLLOW;
create_mode|= O_NOFOLLOW | (internal_table ? 0 : O_EXCL);
}
if (flags & HA_CREATE_CHECKSUM || (options & HA_OPTION_CHECKSUM))
{
@@ -618,8 +618,8 @@ int mi_create(const char *name,uint keys,MI_KEYDEF *keydefs,
{
char *iext= strrchr(name, '.');
int have_iext= iext && !strcmp(iext, MI_NAME_IEXT);
fn_format(kfilename, name, "", MI_NAME_IEXT,
MY_UNPACK_FILENAME | MY_RETURN_REAL_PATH |
fn_format(kfilename, name, "", MI_NAME_IEXT, MY_UNPACK_FILENAME |
(internal_table ? 0 : MY_RETURN_REAL_PATH) |
(have_iext ? MY_REPLACE_EXT : MY_APPEND_EXT));
klinkname_ptr= 0;
/* Replace the current file */