From cd56b40f6dfdfd0dc63a66e44e2f28619913c94a Mon Sep 17 00:00:00 2001
From: Dmitry Shulga <dmitry.shulga@mariadb.com>
Date: Mon, 4 Apr 2022 14:32:16 +0700
Subject: [PATCH] MDEV-28129: MariaDB UAF issue at lex_end_nops(LEX*)

This bug report is not about ASAN Use After Free issue. This bug is
about missed calling of the method LEX::cleanup_lex_after_parse_error
that should happen on parse error.

Aforementioned method calls sphead::restore_thd_mem_root to clean up
resources acquired on processing a stored routine. Particularly,
the method sp_head::restore_tht_mem_root is called to restore
an original mem root and reset LEX::sphead into nullptr.

The method LEX::cleanup_lex_after_parse_error is invoked by the macros
MYSQL_YYABORT. Unfortunately, some rules of grammar for handling
user variables in SQL use YYABORT instead of MYSQL_YYABORT to handle
parser errors. As a consequence, in case a statement with setting of
a user variable is called inside a stored routine, it results in
assert failure in sp_head destructor.

To fix the issue the macros YYABORT should be replaced by MYSQL_YYABORT
in those grammar rules that handle assignment of user variables.
---
 mysql-test/main/sp.result | 12 ++++++++++++
 mysql-test/main/sp.test   | 17 +++++++++++++++++
 sql/sql_yacc.yy           | 12 ++++++------
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/mysql-test/main/sp.result b/mysql-test/main/sp.result
index a7faeaf2f0d..cf51ce96817 100644
--- a/mysql-test/main/sp.result
+++ b/mysql-test/main/sp.result
@@ -8913,3 +8913,15 @@ ERROR 42000: Incorrect usage/placement of 'HIGH_PRIORITY'
 #
 # End of 10.4 tests
 #
+#
+# MDEV-28129: MariaDB UAF issue at lex_end_nops(LEX*)
+#
+CREATE PROCEDURE sp() SELECT 1 INTO @;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1
+CREATE PROCEDURE sp() SET @=1;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '=1' at line 1
+CREATE PROCEDURE sp() SELECT @;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1
+#
+# End of 10.7 tests
+#
diff --git a/mysql-test/main/sp.test b/mysql-test/main/sp.test
index 058f42d5e92..d0d1ebf62b5 100644
--- a/mysql-test/main/sp.test
+++ b/mysql-test/main/sp.test
@@ -10484,3 +10484,20 @@ DELIMITER ;$$
 --echo #
 --echo # End of 10.4 tests
 --echo #
+
+--echo #
+--echo # MDEV-28129: MariaDB UAF issue at lex_end_nops(LEX*)
+--echo #
+
+--error ER_PARSE_ERROR
+CREATE PROCEDURE sp() SELECT 1 INTO @;
+
+--error ER_PARSE_ERROR
+CREATE PROCEDURE sp() SET @=1;
+
+--error ER_PARSE_ERROR
+CREATE PROCEDURE sp() SELECT @;
+
+--echo #
+--echo # End of 10.7 tests
+--echo #
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index ef2a23bae6f..13a891d8622 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -3570,7 +3570,7 @@ simple_target_specification:
             if (!$2.length)
             {
               thd->parse_error();
-              YYABORT;
+              MYSQL_YYABORT;
             }
             $$= new (thd->mem_root) Item_func_get_user_var(thd, &$2);
             if (unlikely($$ == NULL))
@@ -11001,7 +11001,7 @@ variable_aux:
             if (!$1.length)
             {
               thd->parse_error();
-              YYABORT;
+              MYSQL_YYABORT;
             }
             $$= item= new (thd->mem_root) Item_func_set_user_var(thd, &$1, $3);
             if (unlikely($$ == NULL))
@@ -11015,7 +11015,7 @@ variable_aux:
             if (!$1.length)
             {
               thd->parse_error();
-              YYABORT;
+              MYSQL_YYABORT;
             }
             $$= new (thd->mem_root) Item_func_get_user_var(thd, &$1);
             if (unlikely($$ == NULL))
@@ -12653,7 +12653,7 @@ select_outvar:
             if (!$2.length)
             {
               thd->parse_error();
-              YYABORT;
+              MYSQL_YYABORT;
             }
 
             $$ = Lex->result ? new (thd->mem_root) my_var_user(&$2) : NULL;
@@ -14644,7 +14644,7 @@ field_or_var:
             if (!$2.length)
             {
               thd->parse_error();
-              YYABORT;
+              MYSQL_YYABORT;
             }
 
             $$= new (thd->mem_root) Item_user_var_as_out_param(thd, &$2);
@@ -16465,7 +16465,7 @@ option_value_no_option_type:
             if (!$2.length)
             {
               thd->parse_error();
-              YYABORT;
+              MYSQL_YYABORT;
             }
 
             if (sp_create_assignment_lex(thd, $1.str))