From 7b276c0282a9be7a867accd38f67e627df63ac8a Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Sun, 9 Nov 2025 12:11:44 +0100 Subject: [PATCH] MDEV-38001 NULL dereference in Trigger_creation_ctx::create() don't trust the content of a file read from disk --- include/m_string.h | 3 +++ mysql-test/main/trigger-compat.result | 22 ++++++++++------ mysql-test/main/trigger-compat.test | 36 +++++++++++++-------------- sql/sql_trigger.cc | 21 ++++++---------- 4 files changed, 43 insertions(+), 39 deletions(-) diff --git a/include/m_string.h b/include/m_string.h index 4461533cd7c..4ccf55dcbe8 100644 --- a/include/m_string.h +++ b/include/m_string.h @@ -315,6 +315,9 @@ static inline int safe_strcat(char *dst, size_t dst_size, const char *src) #ifdef __cplusplus static inline char *safe_str(char *str) { return str ? str : const_cast(""); } + +static inline const char *safe_str(const LEX_CSTRING *lcs) +{ return lcs && lcs->str ? lcs->str : ""; } #endif static inline const char *safe_str(const char *str) diff --git a/mysql-test/main/trigger-compat.result b/mysql-test/main/trigger-compat.result index dae865ec95c..019eabd7061 100644 --- a/mysql-test/main/trigger-compat.result +++ b/mysql-test/main/trigger-compat.result @@ -1,9 +1,3 @@ -DELETE FROM mysql.user WHERE User LIKE 'mysqltest_%'; -DELETE FROM mysql.db WHERE User LIKE 'mysqltest_%'; -DELETE FROM mysql.tables_priv WHERE User LIKE 'mysqltest_%'; -DELETE FROM mysql.columns_priv WHERE User LIKE 'mysqltest_%'; -FLUSH PRIVILEGES; -DROP DATABASE IF EXISTS mysqltest_db1; CREATE DATABASE mysqltest_db1; CREATE USER mysqltest_dfn@localhost; CREATE USER mysqltest_inv@localhost; @@ -55,7 +49,6 @@ USE test; # # Bug#45235: 5.1 does not support 5.0-only syntax triggers in any way # -DROP TABLE IF EXISTS t1, t2, t3; CREATE TABLE t1 ( a INT ); CREATE TABLE t2 ( a INT ); CREATE TABLE t3 ( a INT ); @@ -445,3 +438,18 @@ DROP TABLE t1; # Listing trigger files # Listing trigger files done # END: Total triggers 2, broken triggers 1, using DROP TRIGGER +# +# MDEV-38001 NULL dereference in Trigger_creation_ctx::create() +# +call mtr.add_suppression('Trigger for table ''test''.''mdev38801'''); +create table mdev38801 (a int); +insert into mdev38801 values (1); +show triggers like 'mdev38801'; +Trigger Event Table Statement Timing Created sql_mode Definer character_set_client collation_connection Database Collation +Warnings: +Warning 1604 Trigger creation context of table `test`.`mdev38801` is invalid +drop table mdev38801; +Warnings: +Warning 1603 Triggers for table `test`.`mdev38801` have no creation context +Warning 1604 Trigger creation context of table `test`.`mdev38801` is invalid +# End of 10.11 tests diff --git a/mysql-test/main/trigger-compat.test b/mysql-test/main/trigger-compat.test index f927a744c0a..f78459060ac 100644 --- a/mysql-test/main/trigger-compat.test +++ b/mysql-test/main/trigger-compat.test @@ -17,19 +17,6 @@ # ########################################################################### -# -# Prepare environment. -# -DELETE FROM mysql.user WHERE User LIKE 'mysqltest_%'; -DELETE FROM mysql.db WHERE User LIKE 'mysqltest_%'; -DELETE FROM mysql.tables_priv WHERE User LIKE 'mysqltest_%'; -DELETE FROM mysql.columns_priv WHERE User LIKE 'mysqltest_%'; -FLUSH PRIVILEGES; - ---disable_warnings -DROP DATABASE IF EXISTS mysqltest_db1; ---enable_warnings - CREATE DATABASE mysqltest_db1; CREATE USER mysqltest_dfn@localhost; @@ -109,11 +96,6 @@ USE test; --echo # --echo # Bug#45235: 5.1 does not support 5.0-only syntax triggers in any way --echo # -let $MYSQLD_DATADIR=`SELECT @@datadir`; - ---disable_warnings -DROP TABLE IF EXISTS t1, t2, t3; ---enable_warnings CREATE TABLE t1 ( a INT ); CREATE TABLE t2 ( a INT ); @@ -503,3 +485,21 @@ DROP TABLE t1; --echo # Listing trigger files done --echo # END: Total triggers 2, broken triggers 1, using DROP TRIGGER + +--echo # +--echo # MDEV-38001 NULL dereference in Trigger_creation_ctx::create() +--echo # +call mtr.add_suppression('Trigger for table ''test''.''mdev38801'''); +create table mdev38801 (a int); +insert into mdev38801 values (1); + +--write_file $MYSQLD_DATADIR/test/mdev38801.TRG +TYPE=TRIGGERS +triggers='' +client_cs_names='' +EOF + +show triggers like 'mdev38801'; +drop table mdev38801; + +--echo # End of 10.11 tests diff --git a/sql/sql_trigger.cc b/sql/sql_trigger.cc index 98d53b33cfd..b251334d1a6 100644 --- a/sql/sql_trigger.cc +++ b/sql/sql_trigger.cc @@ -119,39 +119,33 @@ Trigger_creation_ctx::create(THD *thd, bool invalid_creation_ctx= FALSE; myf utf8_flag= thd->get_utf8_flag(); - if (resolve_charset(client_cs_name->str, + if (resolve_charset(safe_str(client_cs_name), thd->variables.character_set_client, &client_cs, MYF(utf8_flag))) { sql_print_warning("Trigger for table '%s'.'%s': " "invalid character_set_client value (%s).", - (const char *) db_name, - (const char *) table_name, - (const char *) client_cs_name->str); + db_name, table_name, safe_str(client_cs_name)); invalid_creation_ctx= TRUE; } - if (resolve_collation(connection_cl_name->str, + if (resolve_collation(safe_str(connection_cl_name), thd->variables.collation_connection, &connection_cl,MYF(utf8_flag))) { sql_print_warning("Trigger for table '%s'.'%s': " "invalid collation_connection value (%s).", - (const char *) db_name, - (const char *) table_name, - (const char *) connection_cl_name->str); + db_name, table_name, safe_str(connection_cl_name)); invalid_creation_ctx= TRUE; } - if (resolve_collation(db_cl_name->str, NULL, &db_cl, MYF(utf8_flag))) + if (resolve_collation(safe_str(db_cl_name), NULL, &db_cl, MYF(utf8_flag))) { sql_print_warning("Trigger for table '%s'.'%s': " "invalid database_collation value (%s).", - (const char *) db_name, - (const char *) table_name, - (const char *) db_cl_name->str); + db_name, table_name, safe_str(db_cl_name)); invalid_creation_ctx= TRUE; } @@ -162,8 +156,7 @@ Trigger_creation_ctx::create(THD *thd, Sql_condition::WARN_LEVEL_WARN, ER_TRG_INVALID_CREATION_CTX, ER_THD(thd, ER_TRG_INVALID_CREATION_CTX), - (const char *) db_name, - (const char *) table_name); + db_name, table_name); } /*