1
0
mirror of https://github.com/MariaDB/server.git synced 2026-10-23 18:49:29 +03:00

MDEV-40242 Fix Infer NULLPTR_DEREFERENCE reports in tests

Infer flagged several test/unittest sites that dereference the result of
an allocation (or an allocating helper) without checking it for NULL:

- tests/async_queries.c: fatal() calls exit() but was not marked
  noreturn, so Infer assumed add_query() continued past the
  "if (!e || !q2) fatal(...)" guard. Mark fatal() ATTRIBUTE_NORETURN.
- tests/mysql_client_test.c: add the usual check_stmt() after
  mysql_stmt_init() in test_bug16143, test_bug16144 and test_bug38486.
- unittest/json_lib/json_normalize-t.c: check init_dynamic_string().
- unittest/mysys/bitmap-t.c: check my_bitmap_init().
- unittest/mysys/ma_dyncol-t.c: check the val/upd/res malloc()s.
- unittest/mysys/thr_template.c: replace assert(threads) (compiled out
  under NDEBUG) with an unconditional check.
- unittest/sql/mf_iocache-t.cc: check the buf/buf_i/buf_o malloc()s.

Test-only changes; on allocation failure the tests now abort cleanly
via BAIL_OUT() instead of dereferencing NULL.
This commit is contained in:
Vladislav Vaintroub
2026-07-02 10:34:13 +02:00
parent 4a42b823f4
commit c71e43c891
7 changed files with 20 additions and 4 deletions

View File

@@ -99,7 +99,7 @@ static struct my_option options[] =
{ 0, 0, 0, 0, 0, 0, GET_NO_ARG, NO_ARG, 0, 0, 0, 0, 0, 0}
};
static void
static ATTRIBUTE_NORETURN void
fatal(struct state_data *sd, const char *msg)
{
fprintf(stderr, "%s: %s\n", msg, (sd ? mysql_error(&sd->mysql) : ""));

View File

@@ -15739,6 +15739,7 @@ static void test_bug16143()
myheader("test_bug16143");
stmt= mysql_stmt_init(mysql);
check_stmt(stmt);
/* Check mysql_stmt_sqlstate return "no error" */
DIE_UNLESS(strcmp(mysql_stmt_sqlstate(stmt), "00000") == 0);
@@ -15757,6 +15758,7 @@ static void test_bug16144()
/* Check that attr_get returns correct data on little and big endian CPUs */
stmt= mysql_stmt_init(mysql);
check_stmt(stmt);
mysql_stmt_attr_set(stmt, STMT_ATTR_UPDATE_MAX_LENGTH, (const void*) &flag);
mysql_stmt_attr_get(stmt, STMT_ATTR_UPDATE_MAX_LENGTH, (void*) &flag);
DIE_UNLESS(flag == flag_orig);
@@ -18410,6 +18412,7 @@ static void test_bug38486(void)
myheader("test_bug38486");
stmt= mysql_stmt_init(mysql);
check_stmt(stmt);
mysql_stmt_attr_set(stmt, STMT_ATTR_CURSOR_TYPE, (void*)&type);
stmt_text= "CREATE TABLE t1 (a INT)";
mysql_stmt_prepare(stmt, stmt_text, strlen(stmt_text));
@@ -18417,6 +18420,7 @@ static void test_bug38486(void)
mysql_stmt_close(stmt);
stmt= mysql_stmt_init(mysql);
check_stmt(stmt);
mysql_stmt_attr_set(stmt, STMT_ATTR_CURSOR_TYPE, (void*)&type);
stmt_text= "INSERT INTO t1 VALUES (1)";
mysql_stmt_prepare(stmt, stmt_text, strlen(stmt_text));

View File

@@ -223,7 +223,8 @@ check_number_normalize(const char *in, const char *expected)
int err;
DYNAMIC_STRING buf;
init_dynamic_string(&buf, NULL, 0, 0);
if (init_dynamic_string(&buf, NULL, 0, 0))
BAIL_OUT("init_dynamic_string failed (out of memory)");
err= json_normalize_number(&buf, in, strlen(in));
ok(err == 0, "normalize number err?");

View File

@@ -562,7 +562,8 @@ my_bool test_bitmap_exists_intersection(MY_BITMAP *map, uint bitsize)
maps[0]= map;
maps[1]= &map2;
my_bitmap_init(&map2, 0, bitsize);
if (my_bitmap_init(&map2, 0, bitsize))
BAIL_OUT("my_bitmap_init failed (out of memory)");
bitmap_clear_all(map);
bitmap_clear_all(&map2);

View File

@@ -652,6 +652,8 @@ void test_update_many(uint *column_numbers, uint *column_values,
update_count);
res= (DYNAMIC_COLUMN_VALUE *)malloc(sizeof(DYNAMIC_COLUMN_VALUE) *
result_count);
if (!val || !upd || !res)
BAIL_OUT("malloc failed (out of memory)");
for (i= 0; i < column_count; i++)

View File

@@ -29,7 +29,8 @@ void test_concurrently(const char *test, pthread_handler handler, int n, int m)
int i;
ulonglong now= my_interval_timer();
assert(threads);
if (!threads)
BAIL_OUT("malloc failed (out of memory)");
bad= 0;
diag("Testing %s with %d threads, %d iterations... ", test, n, m);

View File

@@ -118,6 +118,8 @@ void temp_io_cache()
{
int res;
uchar *buf= (uchar *)malloc(CACHE_SIZE + 200);
if (!buf)
BAIL_OUT("malloc failed (out of memory)");
memset(buf, FILL, CACHE_SIZE + 200);
diag("temp io_cache with%s encryption", encrypt_tmp_files?"":"out");
@@ -309,6 +311,8 @@ void mdev17133()
const size_t read_size= eof_block_size / read_iter;
size_t total;
if (!buf_i || !buf_o)
BAIL_OUT("malloc failed (out of memory)");
srand((uint) time(NULL));
memset(buf_i, 0, BUFF_SIZE17133);
memset(buf_o, FILL, BUFF_SIZE17133);
@@ -398,6 +402,9 @@ void mdev10963()
myf my_flags= MYF(MY_WME);
const char *file_name="cache.log";
if (!buf)
BAIL_OUT("malloc failed (out of memory)");
memset(buf, FILL, BUFF_SIZE10963);
diag("MDEV-10963 Fragmented BINLOG query");