database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00
Code Activity

MDEV-39653 AddressSanitizer: heap-use-after-free in my_mb_wc_latin1/../Field_xmltype::store after invalid xml.

Browse Source 
The Field_blob::store can affect the 'from' argument so it can't be used
after it.
This commit is contained in:
Alexey Botchkov
2026-05-19 15:27:22 +04:00
parent cbf32fbe82
commit 6b79d98fc0
3 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
plugin/type_xmltype/mysql-test/type_xmltype/type_xmltype.result
View File

@@ -359,4 +359,13 @@ ERROR HY000: Incorrect XMLTYPE value: 'a'
SET sql_mode= default;
DROP PROCEDURE sp;
DROP TABLE t;
#
# MDEV-39653 AddressSanitizer: heap-use-after-free in my_mb_wc_latin1/../Field_xmltype::store after invalid xml.
#
CREATE TABLE t1 (i INT);
INSERT INTO t1 VALUES (1),(2),(3),(4);
CREATE TABLE t2 (x XMLTYPE not null);
INSERT IGNORE INTO t2 SELECT i FROM t1;
ERROR HY000: Incorrect XMLTYPE value: '1'
DROP TABLE t1, t2;
# End of 12.3 tests

13
plugin/type_xmltype/mysql-test/type_xmltype/type_xmltype.test
View File

@@ -289,4 +289,17 @@ SET sql_mode= default;
DROP PROCEDURE sp;
DROP TABLE t;
--echo #
--echo # MDEV-39653 AddressSanitizer: heap-use-after-free in my_mb_wc_latin1/../Field_xmltype::store after invalid xml.
--echo #
CREATE TABLE t1 (i INT);
INSERT INTO t1 VALUES (1),(2),(3),(4);
CREATE TABLE t2 (x XMLTYPE not null);
--error ER_WRONG_VALUE
INSERT IGNORE INTO t2 SELECT i FROM t1;
DROP TABLE t1, t2;
--echo # End of 12.3 tests

6
plugin/type_xmltype/sql_type_xmltype.cc
View File

@@ -216,13 +216,13 @@ int Field_xmltype::store(const char *from, size_t length, CHARSET_INFO *cs)
return Field_blob::store(from, length, cs);
err:
my_error(ER_WRONG_VALUE, MYF(0),
"XMLTYPE", ErrConvString(from, length, cs).ptr());
if (maybe_null())
set_null();
else
Field_blob::store(STRING_WITH_LEN("<invalid_xml_replaced />"), cs);
my_error(ER_WRONG_VALUE, MYF(0),
"XMLTYPE", ErrConvString(from, length, cs).ptr());
return -1;
}