database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-08-01 03:47:19 +03:00
Code Activity

Bug#14466617 - INVALID WRITES AND/OR CRASH WITH USER

Browse Source 
VARIABLES 

Analysis:
-------------
After executing the query, new value of the user defined
variables are set in the function "select_dumpvar::send_data".
"select_dumpvar::send_data" first calls function 
"Item_func_set_user_var::save_item_result()". This function
checks the nullness of the Item_field passed as parameter 
to it and saves it. The nullness of item is stored with 
arg[0]'s null_value flag. Then "select_dumpvar::send_data" calls
"Item_func_set_user_var::update()" which notices null 
result that was saved and calls "Item_func_set_user_var::
update_hash". But here null_value is not set and args[0]
is different from that given to function "Item_func_set_user_var::
set_item_result()". This causes "Item_func_set_user_var::
update_hash" function to believe that its getting non-null value.
"user_var_entry::length" set to 0 and hence "user_var_entry::value"
is made to point to extra_area allocated in "user_var_entry".
And "Item_func_set_user_var::update_hash" tries to write
at memory beyond extra_area for result type DECIMAL. Because of 
this invalid write issue is reported by Valgrind.

Before this bug was introduced, we avoided this problem by 
creating "Item_func_set_user_var" object with the same 
Item_field as arg[0] and as parameter to 
Item_func_set_user_var::save_item_result(). But now 
they are refering to different args[0]. Because of this
null_value flag set in parameter Item_field in function
"Item_func_set_user_var::save_item_result()" is not
reflected in "Item_func_set_user_var" object.

Fix:
------------
This issue is reported on versions 5.5.24. Issue does not exists
in 5.5.23, 5.1, 5.6 and trunk.

This issue was introduced by
revid:georgi.kodinov@oracle.com-20120309130449-82e3bs5v3et1x0ef (fix for
bug #12408412), which was pushed into 5.5 and later releases. This patch
has later been reversed in 5.6 and trunk by
revid:norvald.ryeng@oracle.com-20121010135242-xj34gg73h04hrmyh (fix for
bug #14664077). Backported this patch in 5.5 also to fix this issue.


sql/item_func.cc:
  here unsigned value is converted to signed value.
sql/item_func.h:
  last_insert_id() gives an auto_incremented value which can be
  positive only,so defined it as a unsigned longlong sets the
  unsigned_flag to 1.
This commit is contained in:
Praveenkumar Hulakund
2012-11-07 19:08:33 +05:30
parent f5fbcfe3c8
commit d912a758b0
7 changed files with 61 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
sql/sql_class.cc
View File

@ -2884,12 +2884,7 @@ bool select_exists_subselect::send_data(List<Item> &items)
int select_dumpvar::prepare(List<Item> &list, SELECT_LEX_UNIT *u)
{
unit= u;
List_iterator_fast<my_var> var_li(var_list);
List_iterator_fast<Item> it(list);
Item *item;
my_var *mv;
Item_func_set_user_var **suv;
if (var_list.elements != list.elements)
{
my_message(ER_WRONG_NUMBER_OF_COLUMNS_IN_SELECT,
@ -2897,29 +2892,6 @@ int select_dumpvar::prepare(List<Item> &list, SELECT_LEX_UNIT *u)
return 1;
}
/*
Iterate over the destination variables and mark them as being
updated in this query.
We need to do this at JOIN::prepare time to ensure proper
const detection of Item_func_get_user_var that is determined
by the presence of Item_func_set_user_vars
*/
suv= set_var_items= (Item_func_set_user_var **)
sql_alloc(sizeof(Item_func_set_user_var *) * list.elements);
while ((mv= var_li++) && (item= it++))
{
if (!mv->local)
{
*suv= new Item_func_set_user_var(mv->s, item);
(*suv)->fix_fields(thd, 0);
}
else
*suv= NULL;
suv++;
}
return 0;
}
@ -3236,33 +3208,41 @@ bool select_dumpvar::send_data(List<Item> &items)
List_iterator<Item> it(items);
Item *item;
my_var *mv;
Item_func_set_user_var **suv;
DBUG_ENTER("select_dumpvar::send_data");
if (unit->offset_limit_cnt)
{ // using limit offset,count
unit->offset_limit_cnt--;
DBUG_RETURN(0);
DBUG_RETURN(false);
}
if (row_count++)
{
my_message(ER_TOO_MANY_ROWS, ER(ER_TOO_MANY_ROWS), MYF(0));
DBUG_RETURN(1);
DBUG_RETURN(true);
}
for (suv= set_var_items; ((mv= var_li++) && (item= it++)); suv++)
while ((mv= var_li++) && (item= it++))
{
if (mv->local)
{
DBUG_ASSERT(!*suv);
if (thd->spcont->set_variable(thd, mv->offset, &item))
DBUG_RETURN(1);
DBUG_RETURN(true);
}
else
{
DBUG_ASSERT(*suv);
(*suv)->save_item_result(item);
if ((*suv)->update())
DBUG_RETURN (1);
/*
Create Item_func_set_user_vars with delayed non-constness. We
do this so that Item_get_user_var::const_item() will return
the same result during
Item_func_set_user_var::save_item_result() as they did during
optimization and execution.
*/
Item_func_set_user_var *suv=
new Item_func_set_user_var(mv->s, item, true);
if (suv->fix_fields(thd, 0))
DBUG_RETURN(true);
suv->save_item_result(item);
if (suv->update())
DBUG_RETURN(true);
}
}
DBUG_RETURN(thd->is_error());